Kubernetes 仪表板服务器上的错误 ("unknown") 已阻止请求成功

Question

在启动并运行我的 k8s 集群后，我忠实地部署了以下 WebUI 仪表板使用命令：

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.4/aio/deploy/recommended.yaml

当我尝试访问它时出现以下错误：

Metric client health check failed: an error on the server ("unknown") has prevented the request from succeeding (get services dashboard-metrics-scraper)

如果我得到我得到的所有服务：

k get services --all-namespaces
NAMESPACE              NAME                        TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)         AGE
default                kubernetes                  ClusterIP   10.96.0.1     <none>        443/TCP         8d
kube-system            kube-dns                    ClusterIP   10.96.0.10    <none>        53/UDP,53/TCP   8d
kubernetes-dashboard   dashboard-metrics-scraper   ClusterIP   10.96.0.65    <none>        8000/TCP        6m10s
kubernetes-dashboard   kubernetes-dashboard        ClusterIP   10.96.0.173   <none>        443/TCP         6m10s

有人可以解释一下吗？我错过了什么？

更多信息：在仪表板 yaml 中，我找到了这些角色：

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
    verbs: ["get", "update", "delete"]
   
 map.
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["kubernetes-dashboard-settings"]
    verbs: ["get", "update"]
    
  - apiGroups: [""]
    resources: ["services"]
    resourceNames: ["heapster", "dashboard-metrics-scraper"]
    verbs: ["proxy"]
  - apiGroups: [""]
    resources: ["services/proxy"]
    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
    verbs: ["get"]

    ---
    
    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
    rules:
      
      - apiGroups: ["metrics.k8s.io"]
        resources: ["pods", "nodes"]
        verbs: ["get", "list", "watch"]
    
    ---
    
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
      namespace: kubernetes-dashboard
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: kubernetes-dashboard
    subjects:
      - kind: ServiceAccount
        name: kubernetes-dashboard
        namespace: kubernetes-dashboard
    
    ---
    
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: kubernetes-dashboard
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: kubernetes-dashboard
    subjects:
      - kind: ServiceAccount
        name: kubernetes-dashboard
        namespace: kubernetes-dashboard

看起来 kubernetes-dashboard 用户可以访问指标服务我可能错了

Answer 1

看起来 kubernetes-dashboard 的服务帐户无法访问所有 kubernetes 资源（特别是，它无法访问度量服务器服务）。

要解决此问题，您应该为仪表板创建一个新的 ServiceAccount 并为其授予更多权限。

这是我在另一个类似的 post 上找到的（小心，因为它会授予仪表板管理员权限，任何使用它的人都可以 destroy/create 新或您的 kubernetes 集群上的现有资源):

   apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
   name: kubernetes-dashboard
   labels:
       k8s-app: kubernetes-dashboard
roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system

如果您没有 cluster-admin ServiceAccount，请按照此模板创建一个：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: kube-system
  labels:
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile

管理员集群角色：

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: admin
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]
    nonResourceURLs: ["*"]

Kubernetes 仪表板服务器上的错误 ("unknown") 已阻止请求成功

Kubernetes Dashboard an error on the server ("unknown") has prevented the request from succeeding

kubernetes

kubernetes-ingress

kubernetes-pod

kubernetes-dashboard