feat(deploy): add standalone dashboard kubeconfig secret generator

Signed-off-by: warjiang <1096409085@qq.com>

Author: warjiang

README.md

@@ -14,6 +14,13 @@ If you don't already have the Karmada, you can launch one by following this [tut
 
 
 ---
+### Generate independent dashboard kubeconfig
+After Karmada control plane is installed and certificates exist in `${HOME}/.karmada` (or `CERT_DIR`), run:
+```bash
+hack/generate-karmada-dashboard-kubeconfig.sh <HOST_CLUSTER_KUBECONFIG> <HOST_CONTEXT_NAME>
+```
+This will create/update `karmada-dashboard-config` in namespace `karmada-system`.
+
 ### Install Karmada-dashboard
 In the following steps, we are going to install Karmada Dashboard on the `host cluster` where running the Karmada
 control plane components. We assume that Karmada was installed in namespace `karmada-system` and Karmada config is 
@@ -60,6 +67,12 @@ Create the secret based on your Karmada config, the Karmada Dashboard will use t
 kubectl create secret generic kubeconfig --from-file=kubeconfig=$HOME/.kube/karmada.config -n karmada-system
 ```
 
+If you installed Karmada with the patched flow that generates dashboard-specific certs (for example, `karmada-dashboard-client.*` under `${HOME}/.karmada`), you can generate an independent dashboard kubeconfig secret with:
+```
+hack/generate-karmada-dashboard-kubeconfig.sh "$HOME/.kube/karmada.config" karmada-host
+```
+This command creates `karmada-dashboard-config` in `karmada-system` and can be used as a standalone post-Karmada installation step.
+
 Deploy Karmada Dashboard:
 ```
 kubectl apply -k artifacts/overlays/nodeport-mode

artifacts/dashboard/karmada-dashboard-api.yaml

@@ -25,10 +25,8 @@ spec:
       containers:
         - command:
             - karmada-dashboard-api
-            - --karmada-kubeconfig=/etc/kubeconfig
+            - --karmada-kubeconfig=/etc/karmada/config/karmada.config
             - --karmada-context=karmada-apiserver
-            - --kubeconfig=/etc/kubeconfig
-            - --context=karmada
             - --insecure-bind-address=0.0.0.0
             - --bind-address=0.0.0.0
           name: karmada-dashboard-api
@@ -62,15 +60,15 @@ spec:
           terminationMessagePath: /dev/termination-log
           terminationMessagePolicy: File
           volumeMounts:
-            - name: kubeconfig
-              subPath: kubeconfig
-              mountPath: /etc/kubeconfig
+            - name: karmada-config
+              subPath: karmada.config
+              mountPath: /etc/karmada/config/karmada.config
       restartPolicy: Always
       terminationGracePeriodSeconds: 30
       volumes:
-        - name: kubeconfig
+        - name: karmada-config
           secret:
-            secretName: kubeconfig
+            secretName: karmada-dashboard-config
 ---
 apiVersion: v1
 kind: Service

artifacts/dashboard/karmada-dashboard-web.yaml

@@ -59,18 +59,18 @@ spec:
           terminationMessagePath: /dev/termination-log
           terminationMessagePolicy: File
           volumeMounts:
-            - name: kubeconfig
-              subPath: kubeconfig
-              mountPath: /etc/kubeconfig
+            - name: karmada-config
+              subPath: karmada.config
+              mountPath: /etc/karmada/config/karmada.config
             - name: dashboard-config
               subPath: prod.yaml
               mountPath: /config/dashboard-config.yaml
       restartPolicy: Always
       terminationGracePeriodSeconds: 30
       volumes:
-        - name: kubeconfig
+        - name: karmada-config
           secret:
-            secretName: kubeconfig
+            secretName: karmada-dashboard-config
         - name: dashboard-config
           configMap:
             name:  karmada-dashboard-configmap

artifacts/dashboard/kubernetes-dashboard-api.yaml

@@ -27,7 +27,7 @@ spec:
             - kubernetes-dashboard-api
             - --bind-address=0.0.0.0
             - --insecure-bind-address=0.0.0.0
-            - --karmada-kubeconfig=/etc/kubeconfig
+            - --karmada-kubeconfig=/etc/karmada/config/karmada.config
             - --karmada-context=karmada-apiserver
             - --openapi-enabled
             - --metrics-provider=none
@@ -61,15 +61,15 @@ spec:
           terminationMessagePath: /dev/termination-log
           terminationMessagePolicy: File
           volumeMounts:
-            - name: kubeconfig
-              subPath: kubeconfig
-              mountPath: /etc/kubeconfig
+            - name: karmada-config
+              subPath: karmada.config
+              mountPath: /etc/karmada/config/karmada.config
       restartPolicy: Always
       terminationGracePeriodSeconds: 30
       volumes:
-        - name: kubeconfig
+        - name: karmada-config
           secret:
-            secretName: kubeconfig
+            secretName: karmada-dashboard-config
 ---
 apiVersion: v1
 kind: Service

artifacts/deploy/karmada-config-secret.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${component}-config
+  namespace: karmada-system
+stringData:
+  karmada.config: |-
+    apiVersion: v1
+    kind: Config
+    preferences: {}
+    clusters:
+    - name: karmada-apiserver
+      cluster:
+        certificate-authority-data: ${ca_crt}
+        server: https://karmada-apiserver.karmada-system.svc.cluster.local:5443
+    users:
+    - name: karmada-apiserver
+      user:
+        client-certificate-data: ${client_crt}
+        client-key-data: ${client_key}
+    contexts:
+    - name: karmada-apiserver
+      context:
+        cluster: karmada-apiserver
+        user: karmada-apiserver
+    current-context: karmada-apiserver

charts/karmada-dashboard/templates/karmada-dashboard-api.yaml

@@ -65,12 +65,12 @@ spec:
           volumeMounts:
             - name: kubeconfig-secret
               subPath: kubeconfig
-              mountPath: /etc/kubeconfig
+              mountPath: /etc/kubeconfig/kubeconfig
           command:
             - karmada-dashboard-api
-            - --karmada-kubeconfig=/etc/kubeconfig
+            - --karmada-kubeconfig=/etc/kubeconfig/kubeconfig
             - --karmada-context={{ .Values.api.kubeconfigContext }}
-            - --kubeconfig=/etc/kubeconfig
+            - --kubeconfig=/etc/kubeconfig/kubeconfig
             - --context={{ .Values.api.kubeconfigContext }}
             - --insecure-bind-address=0.0.0.0
             - --bind-address=0.0.0.0

charts/karmada-dashboard/templates/karmada-dashboard-clean-serviceaccount.yaml

@@ -23,12 +23,12 @@ spec:
         args:
           - |
             set +e
-            /opt/bitnami/kubectl/bin/kubectl --kubeconfig=/etc/kubeconfig delete -f /etc/config
+            /opt/bitnami/kubectl/bin/kubectl --kubeconfig=/etc/kubeconfig/kubeconfig delete -f /etc/config
             set -e
         volumeMounts:
           - name: kubeconfig-secret
             subPath: kubeconfig
-            mountPath: /etc/kubeconfig
+            mountPath: /etc/kubeconfig/kubeconfig
           - name: serviceaccount-configmap
             subPath: serviceaccount
             mountPath: /etc/config

charts/karmada-dashboard/templates/karmada-dashboard-init-serviceaccount.yaml

@@ -22,11 +22,11 @@ spec:
         command: [ "/bin/bash", "-c" ]
         args:
           - |
-            /opt/bitnami/kubectl/bin/kubectl --kubeconfig=/etc/kubeconfig apply -f /etc/config
+            /opt/bitnami/kubectl/bin/kubectl --kubeconfig=/etc/kubeconfig/kubeconfig apply -f /etc/config
         volumeMounts:
           - name: kubeconfig-secret
             subPath: kubeconfig
-            mountPath: /etc/kubeconfig
+            mountPath: /etc/kubeconfig/kubeconfig
           - name: serviceaccount-configmap
             subPath: serviceaccount
             mountPath: /etc/config

charts/karmada-dashboard/templates/kubernetes-dashboard-api.yaml

@@ -61,10 +61,10 @@ spec:
           volumeMounts:
             - name: kubeconfig-secret
               subPath: kubeconfig
-              mountPath: /etc/kubeconfig
+              mountPath: /etc/kubeconfig/kubeconfig
           command:
             - kubernetes-dashboard-api
-            - --karmada-kubeconfig=/etc/kubeconfig
+            - --karmada-kubeconfig=/etc/kubeconfig/kubeconfig
             - --karmada-context={{ .Values.kubernetes_dashboard_api.kubeconfigContext }}
             - --insecure-bind-address=0.0.0.0
             - --bind-address=0.0.0.0

hack/README.md

@@ -11,3 +11,10 @@ Differences from the main repository are:
 
 # Usage
 ## start a mininal karmada environment
+
+## generate independent dashboard kubeconfig secret
+After Karmada control plane is installed and certificates exist in `${HOME}/.karmada` (or `CERT_DIR`), run:
+```bash
+hack/generate-karmada-dashboard-kubeconfig.sh <HOST_CLUSTER_KUBECONFIG> <HOST_CONTEXT_NAME>
+```
+This will create/update `karmada-dashboard-config` in namespace `karmada-system`.