您可能需要将 Jmeter 板服务帐户绑定到群集管理员角色：
第一个月
否则， Jmeter 板服务帐户将无法访问填充 Jmeter 板的数据。

我是根据我使用v2.1.0和K8s v1.20的经验来回答这个问题的。安装kubernetes-dashboard时，它创建了一个服务帐户和两个名为“kubernetes-dashboard”的角色，并将这两个角色与dashboard命名空间绑定，将另一个角色与群集范围的角色（但不是群集管理员）绑定。因此，遗憾的是，权限不足以管理整个群集，如下所示：

安装日志：

$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.1.0/aio/deploy/recommended.yaml
namespace/kubernetes-dashboard created
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created

查看您看到的权限：

$ kubectl describe clusterrole kubernetes-dashboard
Name:         kubernetes-dashboard
Labels:       k8s-app=kubernetes-dashboard
Annotations:  <none>
PolicyRule:
Resources             Non-Resource URLs  Resource Names  Verbs
 ---------             -----------------  --------------  -----
nodes.metrics.k8s.io  []                 []              [get list watch]
pods.metrics.k8s.io   []                 []              [get list watch]

$ kubectl describe role kubernetes-dashboard -n kubernetes-dashboard
Name:         kubernetes-dashboard
Labels:       k8s-app=kubernetes-dashboard
Annotations:  <none>
PolicyRule:
Resources       Non-Resource URLs  Resource Names                     Verbs
---------       -----------------  --------------                     -----
secrets         []                 [kubernetes-dashboard-certs]       [get update delete]
secrets         []                 [kubernetes-dashboard-csrf]        [get update delete]
secrets         []                 [kubernetes-dashboard-key-holder]  [get update delete]
configmaps      []                 [kubernetes-dashboard-settings]    [get update]
services/proxy  []                 [dashboard-metrics-scraper]        [get]
services/proxy  []                 [heapster]                         [get]
services/proxy  []                 [http:dashboard-metrics-scraper]   [get]
services/proxy  []                 [http:heapster:]                   [get]
services/proxy  []                 [https:heapster:]                  [get]
services        []                 [dashboard-metrics-scraper]        [proxy]
services        []                 [heapster]                         [proxy]

与其将kubernetes-dashboard服务帐户设置为cluster-admin（因为该帐户用于数据收集），不如创建一个只有令牌的新服务帐户，这样可以轻松撤销该帐户，而不必更改预先创建的帐户的权限。
要创建名为“dashboard-admin”的新服务帐户并以声明方式应用：

$ nano dashboard-svcacct.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
name: dashboard-admin
namespace: kubernetes-dashboard

$ kubectl apply -f dashboard-svcacct.yaml
serviceaccount/dashboard-admin created

将新服务帐户绑定到群集管理员角色：

$ nano dashboard-binding.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: dashboard-admin
  namespace: kubernetes-dashboard

$ kubectl apply -f dashboard-binding.yaml
clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created

要从此服务帐户提取可用于登录的令牌：

$ kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep dashboard-admin | awk '{print $1}')
Name:         dashboard-admin-token-4fxtt
Namespace:    kubernetes-dashboard
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: 9cd5bb80-7901-413b-9eac-7b72c353d4b9

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1066 bytes
namespace:  20 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6Ikp3ZERpQTFPOV<REDACTED>

现在可以使用以“eyJ”开头的整个令牌登录：

但是，剪切和粘贴令牌登录可能会成为一个痛苦的后方，特别是考虑到默认超时。我更喜欢一个配置文件。对于此选项，将需要集群CA哈希。此配置文件的cluster部分与~/.kube/config下的配置文件相同。此配置文件不需要加载到kubernetes主机，我只需要在工作站上使用浏览器访问 Jmeter 板，我将其命名为dashboard-config，并使用VS代码创建它（任何编辑，只需要确保您展开文本以确保散列值中没有空格）。无需将任何管理员CA和私钥哈希保存在用户下：如果复制配置文件。

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: <CLUSTER CA HASH HERE>
    server: https://<IP ADDR OF CLUSTER>:6443
  name: kubernetes #name of cluster
contexts:
- context:
   cluster: kubernetes
   user: dashboard-admin
  name: dashboard-admin@kubernetes
current-context: dashboard-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-dashboard
  user:
    token: <TOKEN HASH from above command e.g. eyJ>

现在起作用了。

我用这个为我工作：

kubectl create clusterrolebinding permissive-binding --clusterrole=cluster-admin --user=admin --user=kubelet --group=system:serviceaccounts:ci