How to sign in kubernetes dashboard

Question

I just upgraded kubeadm and kubelet to v1 8 0  And install the dashboard following the official document     kubectl apply -f https   raw githubusercontent com kubernetes dashboard master src deploy recommended kubernetes-dashboard yaml   After that  I started the dashboard by running    kubectl proxy --address  192 168 0 101  -p 8001 --accept-hosts         Then fortunately  I was able to access the dashboard thru http   192 168 0 101 8001 api v1 namespaces kube-system services https kubernetes-dashboard  proxy   I was redirected to a login page like this which I had never met before    It looks like that there are two ways of authentication    I tried to upload the  etc kubernetes admin conf as the kubeconfig but got failed  Then I tried to use the token I got from kubeadm token list to sign in but failed again    The question is how I can sign in the dashboard  It looks like they added a lot of security mechanism than before  Thanks

User · Answer

Combining two answers  49992698 and 47761914     Create service account kubectl create serviceaccount -n kube-system cluster-admin-dashboard-sa    Bind ClusterAdmin role to the service account kubectl create clusterrolebinding -n kube-system cluster-admin-dashboard-sa     --clusterrole cluster-admin     --serviceaccount kube-system cluster-admin-dashboard-sa    Parse the token TOKEN   kubectl describe secret -n kube-system   kubectl get secret -n kube-system   awk    cluster-admin-dashboard-sa-token-  print  1      awk   1   quot token  quot  print  2

User · Answer

All the previous answers are good to me  But a straight forward answer on my side would come from https   github com kubernetes dashboard wiki Creating-sample-user bearer-token  Just use kubectl -n kube-system describe secret   kubectl -n kube-system get secret   grep admin-user   awk   print  1     You will have many values for some keys  Name  Namespace  Labels       token   The most important is the token that corresponds to your name  copy that token and paste it in the token box  Hope this helps

User · Answer

You need to follow these steps before the token authentication   Create a Cluster Admin service account  kubectl create serviceaccount dashboard -n default  Add the cluster binding rules to your dashboard account  kubectl create clusterrolebinding dashboard-admin -n default --clusterrole cluster-admin --serviceaccount default dashboard  Get the secret token with this command  kubectl get secret   kubectl get serviceaccount dashboard -o jsonpath    secrets 0  name    -o jsonpath    data token     base64 --decode  Choose token authentication in the  Kubernetes dashboard login page  Now you can able to login

User · Answer

The skip login has been disabled by default due to security issues  https   github com kubernetes dashboard issues 2672  in your dashboard yaml add this arg   - --enable-skip-login   to get it back

User · Answer

If you don t want to grant admin permission to dashboard service account  you can create cluster admin service account     kubectl create serviceaccount cluster-admin-dashboard-sa   kubectl create clusterrolebinding cluster-admin-dashboard-sa     --clusterrole cluster-admin     --serviceaccount default cluster-admin-dashboard-sa   And then  you can use the token of just created cluster admin service account     kubectl get secret   grep cluster-admin-dashboard-sa cluster-admin-dashboard-sa-token-6xm8l   kubernetes io service-account-token   3         18m   kubectl describe secret cluster-admin-dashboard-sa-token-6xm8l   I quoted it from giantswarm guide - https   docs giantswarm io guides install-kubernetes-dashboard

User · Answer

Download  https   raw githubusercontent com kubernetes dashboard master src deploy alternative kubernetes-dashboard yaml  add  type  NodePort for the Service   And then run this command   kubectl apply -f kubernetes-dashboard yaml   Find the exposed port with the command    kubectl get services -n kube-system   You should be able to get the dashboard at http   hostname exposedport  with no authentication

User · Answer

As of release 1 7 Dashboard supports user authentication based on          Authorization  Bearer  lt token gt  header passed in every request to Dashboard  Supported from release 1 6  Has the highest priority  If present  login view will not be shown    Bearer Token that can be used on Dashboard login view    Username password that can be used on Dashboard login view    Kubeconfig file that can be used on Dashboard login view           Dashboard on Github  Token  Here Token can be Static Token  Service Account Token  OpenID Connect Token from Kubernetes Authenticating  but not the kubeadm Bootstrap Token   With kubectl  we can get an service account  eg  deployment controller  created in kubernetes by default     kubectl -n kube-system get secret   All secrets with type  kubernetes io service-account-token  will allow to log in    Note that they have different privileges  NAME                                     TYPE                                  DATA      AGE deployment-controller-token-frsqj        kubernetes io service-account-token   3         22h    kubectl -n kube-system describe secret deployment-controller-token-frsqj Name          deployment-controller-token-frsqj Namespace     kube-system Labels         lt none gt  Annotations   kubernetes io service-account name deployment-controller               kubernetes io service-account uid 64735958-ae9f-11e7-90d5-02420ac00002  Type   kubernetes io service-account-token  Data      ca crt      1025 bytes namespace   11 bytes token       eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9 eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkZXBsb3ltZW50LWNvbnRyb2xsZXItdG9rZW4tZnJzcWoiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVwbG95bWVudC1jb250cm9sbGVyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNjQ3MzU5NTgtYWU5Zi0xMWU3LTkwZDUtMDI0MjBhYzAwMDAyIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRlcGxveW1lbnQtY29udHJvbGxlciJ9 OqFc4CE1Kh6T3BTCR4XxDZR8gaF1MvH4M3ZHZeCGfO-sw-D0gp826vGPHr 0M66SkGaOmlsVHmP7zmTi-SJ3NCdVO5viHaVUwPJ62hx88 JPmSfD0KJJh6G5QokKfiO0WlGN7L1GgiZj18zgXVYaJShlBSz5qGRuGf0s1jy9KOBt9slAN5xQ9 b88amym2GIXoFyBsqymt5H-iMQaGP35tbRpewKKtly9LzIdrO23bDiZ1voc5QZeAZIWrizzjPY5HPM1qOqacaY9DcGc7akh98eBJG 4vZqH2gKy76fMf0yInFTeNKr45 6fWt8gRM77DQmPwb3hbrjWXe1VvXX g   Kubeconfig  The dashboard needs the user in the kubeconfig file to have either username  amp  password or token  but admin conf only has client-certificate   You can edit the config file to add the token that was extracted using the method above      kubectl config set-credentials cluster-admin --token bearer token  Alternative  Not recommended for Production   Here are two ways to bypass the authentication  but use for caution    Deploy dashboard with HTTP    kubectl apply -f https   raw githubusercontent com kubernetes dashboard master src deploy alternative kubernetes-dashboard yaml   Dashboard can be loaded at http   localhost 8001 ui with kubectl proxy   Granting admin privileges to Dashboard s Service Account    cat  lt  lt EOF   kubectl create -f - apiVersion  rbac authorization k8s io v1beta1 kind  ClusterRoleBinding metadata    name  kubernetes-dashboard   labels      k8s-app  kubernetes-dashboard roleRef    apiGroup  rbac authorization k8s io   kind  ClusterRole   name  cluster-admin subjects  - kind  ServiceAccount   name  kubernetes-dashboard   namespace  kube-system EOF   Afterwards you can use Skip option on login page to access Dashboard   If you are using dashboard version v1 10 1 or later  you must also add --enable-skip-login to the deployment s command line arguments  You can do so by adding it to the args in kubectl edit deployment kubernetes-dashboard --namespace kube-system   Example         containers        - args          - --auto-generate-certificates         - --enable-skip-login               lt -- add this line         image  k8s gcr io kubernetes-dashboard-amd64 v1 10 1

User · Answer

TL DR  To get the token in a single oneliner   kubectl -n kube-system describe secret   kubectl -n kube-system get secret   awk    deployment-controller-token-  print  1      awk   1   token   print  2     This assumes that your    kube config is present and valid  And also that kubectl config get-contexts indicates that you are using the correct context  cluster and namespace  for the dashboard you are logging into   Explanation  I derived this answer from what I learned from  silverfox s answer  That is a very informative write up  Unfortunately it falls short of telling you how to actually put the information into practice  Maybe I ve been doing DevOps too long  but I think in shell  It s much more difficult for me to learn or teach in English   Here is that oneliner with line breaks and indents for readability   kubectl -n kube-system describe secret      kubectl -n kube-system get secret       awk    deployment-controller-token-  print  1         awk   1   token   print  2     There are 4 distinct commands and they get called in this order    Line 2 - This is the first command from  silverfox s Token section  Line 3 - Print only the first field of the line beginning with deployment-controller-token-  which is the pod name  Line 1 - This is the second command from  silverfox s Token section  Line 5 - Print only the second field of the line whose first field is  token

User · Answer

A self-explanatory simple one-liner to extract token for kubernetes dashboard login   kubectl describe secret -n kube-system   grep deployment -A 12   Copy the token and paste it on the kubernetes dashboard under token sign in option and you are good to use kubernetes dashboard

[kubernetes] How to sign in kubernetes dashboard?

Examples related to kubernetes

Examples related to dashboard