Accessing Dashboard

    This document only describes the basic ways of accessing Kubernetes Dashboard Recommended Setup deployment. It will also work if you have used recommended setup with your custom certificates. If you have decided to follow the path, then the only difference is that instead of exposing Dashboard over HTTPS, it is exposed over HTTP by default. As the alternative setup is recommended for advanced users only, we’ll not describe in detail how to use it here.

    kubectl proxy

    kubectl proxy creates a proxy server between your machine and Kubernetes API server. By default, it is only accessible locally (from the machine that started it).

    First let’s check if kubectl is properly configured and has access to the cluster. In case of error follow to install and set up kubectl.

    The output is similar to this:

    1. Kubernetes master is running at https://192.168.30.148:6443
    2. KubeDNS is running at https://192.168.30.148:6443/api/v1/namespaces/kube-system/services/kube-dns/proxy
    4. To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

    Start local proxy server.

    1. kubectl proxy

    The output is similar to this:

    Once the proxy server has been started you should be able to access Dashboard from your browser.

    1. http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/

    Instead of kubectl proxy, you can use kubectl port-forward and access dashboard with simpler URL than using kubectl proxy.

    1. kubectl port-forward -n kubernetes-dashboard service/kubernetes-dashboard 8080:443

    To access Kubernetes Dashboard go to:

    NodePort

    This way of accessing Dashboard is only recommended for development environments in a single node setup.

    Edit kubernetes-dashboard service.

      You should see yaml representation of the service. Change to type: NodePort and save file. If it’s already changed go to next step.

      1. # Please edit the object below. Lines beginning with a '#' will be ignored,
      2. # and an empty file will abort the edit. If an error occurs while saving this file will be
      3. # reopened with the relevant failures.
      4. #
      5. apiVersion: v1
      6. ...
      7.   name: kubernetes-dashboard
      8.   namespace: kubernetes-dashboard
      9.   resourceVersion: "343478"
      10.   selfLink: /api/v1/namespaces/kubernetes-dashboard/services/kubernetes-dashboard
      11.   uid: 8e48f478-993d-11e7-87e0-901b0e532516
      12. spec:
      13.   clusterIP: 10.100.124.90
      14.   externalTrafficPolicy: Cluster
      15.   - port: 443
      16.     protocol: TCP
      17.     targetPort: 8443
      19.     k8s-app: kubernetes-dashboard
      20.   sessionAffinity: None
      21.   type: ClusterIP
      22. status:
      23.   loadBalancer: {}

      Next we need to check port on which Dashboard was exposed.

      The output is similar to this:

      1. NAME                   TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
      2. kubernetes-dashboard   NodePort   10.100.124.90   <nodes>       443:31707/TCP   21h

      In case you are trying to expose Dashboard using NodePort on a multi-node cluster, then you have to find out IP of the node on which Dashboard is running to access it. Instead of accessing https://<master-ip>:<nodePort> you should access https://<node-ip>:<nodePort>.

      In case Kubernetes API server is exposed and accessible from outside you can directly access dashboard at: https://<master-ip>:<apiserver-port>/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/

      Note: This way of accessing Dashboard is only possible if you choose to install your user certificates in the browser. In example, certificates used by the kubeconfig file to contact API Server can be used.

      Ingress

      Dashboard can be also exposed using Ingress resource. For more information check: https://kubernetes.io/docs/concepts/services-networking/ingress.

      If your login view displays below error, this means that you are trying to log in over HTTP and it has been disabled for the security reasons.

      Logging in is available only if URL used to access Dashboard starts with:

      • http://localhost/...
      • http://127.0.0.1/...
      • https://<domain_name>/...