如何为kubernetes桌面UIconfiguration简单的login/传递身份validation
我在kubernetes中很新，我只是通过kubeadm安装kubernetes并运行仪表板UI，但是无法configuration对它的访问。 下面的文档中，我添加行--basic-auth-file=/etc/kubernetes/auth.csv到/etc/kubernetes/manifests/kube-apiserver.yaml，创build文件，并放入一个像pass,admin,adminstring。 但之后，API删除此string并重新启动服务器后，崩溃并恢复正常。 我怎么能通过这个参数到api服务器没有api服务器崩溃，也许别的什么需要添加或从这个文件中删除？ 这是我的
KUBE-apiserver.yaml
apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --admission-control=Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,ResourceQuota - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key - --secure-port=6443 - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname - --requestheader-allowed-names=front-proxy-client - --service-account-key-file=/etc/kubernetes/pki/sa.pub - --client-ca-file=/etc/kubernetes/pki/ca.crt - --enable-bootstrap-token-auth=true - --allow-privileged=true - --requestheader-username-headers=X-Remote-User - --advertise-address=236.273.51.124 - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key - --insecure-port=0 - --requestheader-group-headers=X-Remote-Group - --requestheader-extra-headers-prefix=X-Remote-Extra- - --service-cluster-ip-range=10.96.0.0/12 - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt - --authorization-mode=Node,RBAC - --etcd-servers=http://127.0.0.1:2379 image: gcr.io/google_containers/kube-apiserver-amd64:v1.8.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/pki name: k8s-certs readOnly: true - mountPath: /etc/ssl/certs name: ca-certs readOnly: true - mountPath: /etc/pki name: ca-certs-etc-pki
您的基本authentication文件/etc/kubernetes/auth.csv在kube-apiserver pod的容器内不可用。 它应该安装到容器的容器以及证书文件夹。 只需将其添加到卷和volumeMounts部分：
volumeMounts: - mountPath: /etc/kubernetes/auth.csv name: kubernetes-dashboard readOnly: true volumes: - hostPath: path: /etc/kubernetes/auth.csv name: kubernetes-dashboard