Kubernetes dashboard authentication on atomic host

9/8/2017

I am a total newbie in terms of kubernetes/atomic host, so my question may be really trivial or well discussed already - but unfortunately i couldn't find any clues how to achieve my goal - that's why i am here.

I have set up kubernetes cluster on atomic hosts (right now i have just one master and one node). I am working in the cloud network, on the virtual machines.

[root@master ~]# kubectl get node
NAME          STATUS    AGE
192.168.2.3   Ready     9d

After a lot of fuss i managed to set up the kubernetes dashboard UI on my master.

[root@master ~]# kubectl describe pod  --namespace=kube-system
Name:           kubernetes-dashboard-3791223240-8jvs8
Namespace:      kube-system
Node:           192.168.2.3/192.168.2.3
Start Time:     Thu, 07 Sep 2017 10:37:31 +0200
Labels:         k8s-app=kubernetes-dashboard
                pod-template-hash=3791223240
Status:         Running
IP:             172.16.43.2
Controllers:    ReplicaSet/kubernetes-dashboard-3791223240
Containers:
  kubernetes-dashboard:
    Container ID:       docker://8fddde282e41d25c59f51a5a4687c73e79e37828c4f7e960c1bf4a612966420b
    Image:              gcr.io/google_containers/kubernetes-dashboard-amd64:v1.6.3
    Image ID:           docker-pullable://gcr.io/google_containers/kubernetes-dashboard-amd64@sha256:2c4421ed80358a0ee97b44357b6cd6dc09be6ccc27dfe9d50c9bfc39a760e5fe
    Port:               9090/TCP
    Args:
      --apiserver-host=http://192.168.2.2:8080
    Limits:
      cpu:      100m
      memory:   300Mi
    Requests:
      cpu:                      100m
      memory:                   100Mi
    State:                      Running
      Started:                  Fri, 08 Sep 2017 10:54:46 +0200
    Last State:                 Terminated
      Reason:                   Error
      Exit Code:                2
      Started:                  Thu, 07 Sep 2017 10:37:32 +0200
      Finished:                 Fri, 08 Sep 2017 10:54:44 +0200
    Ready:                      True
    Restart Count:              1
    Liveness:                   http-get http://:9090/ delay=30s timeout=30s period=10s #success=1 #failure=3
    Volume Mounts:              <none>
    Environment Variables:      <none>
Conditions:
  Type          Status
  Initialized   True
  Ready         True
  PodScheduled  True
No volumes.
QoS Class:      Burstable
Tolerations:    <none>
Events:
  FirstSeen     LastSeen        Count   From                    SubObjectPath                           Type            Reason                  Message
  ---------     --------        -----   ----                    -------------                           --------        ------                  -------
  1d            32m             3       {kubelet 192.168.2.3}                                           Warning         MissingClusterDNS       kubelet does not have ClusterDNS IP configured and cannot create Pod using "ClusterFirst" policy. Falling back to DNSDefault policy.
  1d            32m             2       {kubelet 192.168.2.3}   spec.containers{kubernetes-dashboard}   Normal          Pulled                  Container image "gcr.io/google_containers/kubernetes-dashboard-amd64:v1.6.3" already present on machine
  32m           32m             1       {kubelet 192.168.2.3}   spec.containers{kubernetes-dashboard}   Normal          Created                 Created container with docker id 8fddde282e41; Security:[seccomp=unconfined]
  32m           32m             1       {kubelet 192.168.2.3}   spec.containers{kubernetes-dashboard}   Normal          Started                 Started container with docker id 8fddde282e41

also

[root@master ~]# kubectl cluster-info
Kubernetes master is running at http://localhost:8080
kubernetes-dashboard is running at http://localhost:8080/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard

Now, when i tried connecting to the dashboard (i tried accessing the dashbord via the browser on windows virtual machine in the same cloud network) using the adress: https://192.168.218.2:6443/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard I am getting the "unauthorized". I believe it proves that the dashboard is indeed running under this address, but i need to set up some way of accessing it?

What i want to achieve in the long term: i want to enable connecting to the dashboard using the login/password (later, when i learn a bit more, i will think about authenticating by certs or somehting more safe than password) from the outside of the cloud network. For now, connecting to the dashboard at all would do.

I know there are threads about authenticating, but most of them are mentioning something like:

Basic authentication is enabled by passing the --basic-auth-file=SOMEFILE option to API server

And this is the part i cannot cope with - i have no idea how to pass options to API server. On the atomic host the api-server,kube-controller-manager and kube-scheduler are running in containers, so I get into the api-server container with command:

docker exec -it kube-apiserver.service bash

I saw few times that i should edit .json file in /etc/kubernetes/manifest directory, but unfortunately there is no such file (or even a directory).

I apologize if my problem is too trivial or not described well enough, but im new to (both) IT world and the stackoverflow.

I would love to provide more info, but I am afraid I would end up including lots of useless information, so i decided to wait for your instructions in that regard.

-- mstempniewicz
authentication
dashboard
kubernetes

1 Answer

2/8/2018

Check out wiki pages of kubernetes dashboard they describe how to get access to dashboard and how to authenticate to it. For quick access you can run:

kubectl proxy

And then go to following address:

http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy

You'll see two options, one of them is uploading your ~/.kube/config file and the other one is using a token. You can get a token by running following command:

kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep service-account-token | head -n 1 | awk '{print $1}')

Now just copy and paste the long token string into dashboard prompt and you're done.

-- Keyvan Hedayati
Source: StackOverflow