Skip to content

Commit 1b657fe

Browse files
Sonal0409Sonal0409
authored
Create dashboard-Secure.yml
1 parent 51c23e8 commit 1b657fe

File tree

1 file changed

+287
-0
lines changed

1 file changed

+287
-0
lines changed

‎Kubernetese/dashboard-Secure.yml‎

Lines changed: 287 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,287 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: v1
16+
kind: Namespace
17+
metadata:
18+
name: kubernetes-dashboard
19+
20+
---
21+
22+
apiVersion: v1
23+
kind: ServiceAccount
24+
metadata:
25+
labels:
26+
k8s-app: kubernetes-dashboard
27+
name: kubernetes-dashboard
28+
namespace: default
29+
30+
---
31+
32+
kind: Service
33+
apiVersion: v1
34+
metadata:
35+
labels:
36+
k8s-app: kubernetes-dashboard
37+
name: kubernetes-dashboard
38+
namespace: default
39+
spec:
40+
type: NodePort
41+
ports:
42+
- port: 443
43+
targetPort: 8443
44+
selector:
45+
k8s-app: kubernetes-dashboard
46+
47+
---
48+
apiVersion: v1
49+
kind: Secret
50+
metadata:
51+
labels:
52+
k8s-app: kubernetes-dashboard
53+
name: kubernetes-dashboard-certs
54+
namespace: default
55+
type: Opaque
56+
57+
---
58+
59+
apiVersion: v1
60+
kind: Secret
61+
metadata:
62+
labels:
63+
k8s-app: kubernetes-dashboard
64+
name: kubernetes-dashboard-csrf
65+
namespace: default
66+
type: Opaque
67+
data:
68+
csrf: ""
69+
70+
---
71+
72+
apiVersion: v1
73+
kind: Secret
74+
metadata:
75+
labels:
76+
k8s-app: kubernetes-dashboard
77+
name: kubernetes-dashboard-key-holder
78+
namespace: default
79+
type: Opaque
80+
81+
---
82+
83+
kind: ConfigMap
84+
apiVersion: v1
85+
metadata:
86+
labels:
87+
k8s-app: kubernetes-dashboard
88+
name: kubernetes-dashboard-settings
89+
namespace: default
90+
91+
---
92+
93+
kind: Role
94+
apiVersion: rbac.authorization.k8s.io/v1
95+
metadata:
96+
labels:
97+
k8s-app: kubernetes-dashboard
98+
name: kubernetes-dashboard
99+
namespace: default
100+
rules:
101+
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
102+
- apiGroups: [""]
103+
resources: ["secrets"]
104+
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
105+
verbs: ["get", "update", "delete"]
106+
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
107+
- apiGroups: [""]
108+
resources: ["configmaps"]
109+
resourceNames: ["kubernetes-dashboard-settings"]
110+
verbs: ["get", "update"]
111+
# Allow Dashboard to get metrics.
112+
- apiGroups: [""]
113+
resources: ["services"]
114+
resourceNames: ["heapster", "dashboard-metrics-scraper"]
115+
verbs: ["proxy"]
116+
- apiGroups: [""]
117+
resources: ["services/proxy"]
118+
resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
119+
verbs: ["get"]
120+
121+
---
122+
123+
kind: ClusterRole
124+
apiVersion: rbac.authorization.k8s.io/v1
125+
metadata:
126+
labels:
127+
k8s-app: kubernetes-dashboard
128+
name: kubernetes-dashboard
129+
rules:
130+
# Allow Metrics Scraper to get metrics from the Metrics server
131+
- apiGroups: ["metrics.k8s.io"]
132+
resources: ["pods", "nodes"]
133+
verbs: ["get", "list", "watch"]
134+
135+
---
136+
137+
apiVersion: rbac.authorization.k8s.io/v1
138+
kind: RoleBinding
139+
metadata:
140+
labels:
141+
k8s-app: kubernetes-dashboard
142+
name: kubernetes-dashboard
143+
namespace: default
144+
roleRef:
145+
apiGroup: rbac.authorization.k8s.io
146+
kind: Role
147+
name: kubernetes-dashboard
148+
subjects:
149+
- kind: ServiceAccount
150+
name: kubernetes-dashboard
151+
namespace: default
152+
153+
---
154+
155+
apiVersion: rbac.authorization.k8s.io/v1
156+
kind: ClusterRoleBinding
157+
metadata:
158+
name: kubernetes-dashboard
159+
namespace: kubernetes-dashboard
160+
roleRef:
161+
apiGroup: rbac.authorization.k8s.io
162+
kind: ClusterRole
163+
name: cluster-admin
164+
subjects:
165+
- kind: ServiceAccount
166+
name: kubernetes-dashboard
167+
namespace: default
168+
169+
---
170+
171+
kind: Deployment
172+
apiVersion: apps/v1
173+
metadata:
174+
labels:
175+
k8s-app: kubernetes-dashboard
176+
name: kubernetes-dashboard
177+
namespace: default
178+
spec:
179+
replicas: 1
180+
revisionHistoryLimit: 10
181+
selector:
182+
matchLabels:
183+
k8s-app: kubernetes-dashboard
184+
template:
185+
metadata:
186+
labels:
187+
k8s-app: kubernetes-dashboard
188+
spec:
189+
containers:
190+
- name: kubernetes-dashboard
191+
image: kubernetesui/dashboard:v2.0.3 ## kubernetesui/dashboard:v2.0.0-beta1
192+
imagePullPolicy: Always
193+
ports:
194+
- containerPort: 8443
195+
protocol: TCP
196+
args:
197+
- --auto-generate-certificates
198+
- --enable-skip-login
199+
- --bind-address=0.0.0.0
200+
# - --disable-settings-authorizer
201+
#- --insecure-bind-address=0.0.0.0
202+
# - --insecure-port=9090
203+
# - --enable-insecure-login
204+
- --namespace=default
205+
# Uncomment the following line to manually specify Kubernetes API server Host
206+
# If not specified, Dashboard will attempt to auto discover the API server and connect
207+
# to it. Uncomment only if the default does not work.
208+
# - --apiserver-host=http://my-address:port
209+
volumeMounts:
210+
- name: kubernetes-dashboard-certs
211+
mountPath: /certs
212+
# Create on-disk volume to store exec logs
213+
- mountPath: /tmp
214+
name: tmp-volume
215+
livenessProbe:
216+
httpGet:
217+
scheme: HTTPS
218+
path: /
219+
port: 8443
220+
initialDelaySeconds: 30
221+
timeoutSeconds: 30
222+
volumes:
223+
- name: kubernetes-dashboard-certs
224+
secret:
225+
secretName: kubernetes-dashboard-certs
226+
- name: tmp-volume
227+
emptyDir: {}
228+
serviceAccountName: kubernetes-dashboard
229+
# Comment the following tolerations if Dashboard must not be deployed on master
230+
tolerations:
231+
- key: node-role.kubernetes.io/master
232+
effect: NoSchedule
233+
234+
---
235+
236+
kind: Service
237+
apiVersion: v1
238+
metadata:
239+
labels:
240+
k8s-app: kubernetes-metrics-scraper
241+
name: dashboard-metrics-scraper
242+
namespace: default
243+
spec:
244+
ports:
245+
- port: 8000
246+
targetPort: 8000
247+
selector:
248+
k8s-app: kubernetes-metrics-scraper
249+
250+
---
251+
252+
kind: Deployment
253+
apiVersion: apps/v1
254+
metadata:
255+
labels:
256+
k8s-app: kubernetes-metrics-scraper
257+
name: kubernetes-metrics-scraper
258+
namespace: default
259+
spec:
260+
replicas: 1
261+
revisionHistoryLimit: 10
262+
selector:
263+
matchLabels:
264+
k8s-app: kubernetes-metrics-scraper
265+
template:
266+
metadata:
267+
labels:
268+
k8s-app: kubernetes-metrics-scraper
269+
spec:
270+
containers:
271+
- name: kubernetes-metrics-scraper
272+
image: kubernetesui/metrics-scraper:v1.0.0
273+
ports:
274+
- containerPort: 8000
275+
protocol: TCP
276+
livenessProbe:
277+
httpGet:
278+
scheme: HTTP
279+
path: /
280+
port: 8000
281+
initialDelaySeconds: 30
282+
timeoutSeconds: 30
283+
serviceAccountName: kubernetes-dashboard
284+
# Comment the following tolerations if Dashboard must not be deployed on master
285+
tolerations:
286+
- key: node-role.kubernetes.io/master
287+
effect: NoSchedule

0 commit comments

Comments
 (0)