I´d like to login on my newly installed kubernetes dashboard (k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.0) via token and it doesn´t work.
I have the exact same problem as on How to log in to Kubernetes Dashboard UI with Service Account's token but I verified my token and it fits. I also DON´T get the "Authentication failed..." error.
When I enter the token just nothing happens, but I see new entries in the logfile:
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Incoming HTTP/2.0 GET /api/v1/csrftoken/login request from 192.168.178.10:60092: { contents hidden }\n","stream":"stdout","time":"2018-12-07T14:59:49.655298186Z"}
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Outcoming response to 192.168.178.10:60092 with 200 status code\n","stream":"stdout","time":"2018-12-07T14:59:49.655840444Z"}
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Incoming HTTP/2.0 POST /api/v1/login request from 192.168.178.10:60092: { contents hidden }\n","stream":"stdout","time":"2018-12-07T14:59:49.665272088Z"}
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Outcoming response to 192.168.178.10:60092 with 200 status code\n","stream":"stdout","time":"2018-12-07T14:59:49.670318659Z"}
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Incoming HTTP/2.0 GET /api/v1/login/status request from 192.168.178.10:60092: {}\n","stream":"stdout","time":"2018-12-07T14:59:49.688294191Z"}
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Outcoming response to 192.168.178.10:60092 with 200 status code\n","stream":"stdout","time":"2018-12-07T14:59:49.691135283Z"}
{"log":"2018/12/07 14:59:52 Metric client health check failed: the server could not find the requested resource (get services heapster). Retrying in 30 seconds.\n","stream":"stdout","time":"2018-12-07T14:59:52.237740364Z"}
What I´ve done:
kubectl create serviceaccount myservice
kubectl get serviceaccount myservice -o yaml
Token:
TOKEN=$(echo "ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNklpSjkuZXlKcGMzTWlPaUpyZFdKbGNtNWxkR1Z6TDNObGNuWnBZMlZoWTJOdmRXNTBJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5dVlXMWxjM0JoWTJVaU9pSmtaV1poZFd4MElpd2lhM1ZpWlhKdVpYUmxjeTVwYnk5elpYSjJhV05sWVdOamIzVnVkQzl6WldOeVpYUXVibUZ0WlNJNkltMTVjMlZ5ZG1salpTMTBiMnRsYmkxa09ISnlaQ0lzSW10MVltVnlibVYwWlhNdWFXOHZjMlZ5ZG1salpXRmpZMjkxYm5RdmMyVnlkbWxqWlMxaFkyTnZkVzUwTG01aGJXVWlPaUp0ZVhObGNuWnBZMlVpTENKcmRXSmxjbTVsZEdWekxtbHZMM05sY25acFkyVmhZMk52ZFc1MEwzTmxjblpwWTJVdFlXTmpiM1Z1ZEM1MWFXUWlPaUpoWWpFeVlUVmpOUzFtWVRKakxURXhaVGd0WVRZNE55MHdNRFV3TlRZNE9EZzRNak1pTENKemRXSWlPaUp6ZVhOMFpXMDZjMlZ5ZG1salpXRmpZMjkxYm5RNlpHVm1ZWFZzZERwdGVYTmxjblpwWTJVaWZRLm0yR2F4VmNsOTYzVkVjbUltb3dzY25aeWdrd2hQTTBlZmNjUnVoaGNmdlNWXzU5Y29wNkdMc2t0bTRtY1FqcjBnaWhzMTZXZjFrd1VkVjBlTFJNVE1zaWZudlQxR2J6Smd3ZURydTVMbHVteW5tY3Y3Sm1GVDFGLXpJSjI0SFRERVhlVTNtMV9OVjJHcUZHdTNmVTlxOVFscG44ZVRxR2FuNDZLdEM2OTZGUVBqbjFhVnRER28wMlVrU2NwVGRHckNkenFMUjFBT0ZMTXVyUWFjWldIbHlhTmZ4Sy02bU16aDBZdG1seHdfcEFSeVlySXJMVlR2dXlLeDRmQzRvWUx2elVia1pkWmp1eUlJWnFmYXVUMTFKQUFad243MHZyZW1xbVVHTXBsdXNaYVdiU2h3SlJkRWZmMzdjTEd3R3lwdU1SeXI2a3NsVlJiLW50eXdWbHYxQQ==" | base64 -d)
echo $TOKEN
eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6Im15c2VydmljZS10b2tlbi1kOHJyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJteXNlcnZpY2UiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJhYjEyYTVjNS1mYTJjLTExZTgtYTY4Ny0wMDUwNTY4ODg4MjMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpteXNlcnZpY2UifQ.m2GaxVcl963VEcmImowscnZygkwhPM0efccRuhhcfvSV_59cop6GLsktm4mcQjr0gihs16Wf1kwUdV0eLRMTMsifnvT1GbzJgweDru5Llumynmcv7JmFT1F-zIJ24HTDEXeU3m1_NV2GqFGu3fU9q9Qlpn8eTqGan46KtC696FQPjn1aVtDGo02UkScpTdGrCdzqLR1AOFLMurQacZWHlyaNfxK-6mMzh0Ytmlxw_pARyYrIrLVTvuyKx4fC4oYLvzUbkZdZjuyIIZqfauT11JAAZwn70vremqmUGMplusZaWbShwJRdEff37cLGwGypuMRyr6kslVRb-ntywVlv1A
I start
kubectl proxy --port=9999 --address='192.168.178.10' --accept-hosts="^*quot;
Does it work just on localhost (I don´t want to install a browser nor desktop)?
I´d also like to know, to get the dashboard permanently run, as after "ctrl + c" the "kubectl proxy" command.
I found the workarroud
cat <<EOF | kubectl create -f -
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: kubernetes-dashboard
labels:
k8s-app: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: kube-system
EOF
Running this command and "skip" on the dashboard and I´m logged in, but how to get rid of this user as I can´t find it anymore via
kubectl get serviceaccounts --all-namespaces
nor
kubectl get serviceaccounts -n kube-system
?
How to get it run via https?
Thanks in advance Tom
The answer to all my questions I found on
http://www.joseluisgomez.com/containers/kubernetes-dashboard/
Access via kubectl proxy
is not recommended for productive use (but unfortunately the only explained way on the kubernetes documentation).
It´s possible to access out of the box via https, but there are some additional steps required.
grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt
grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key
openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name "kubernetes-client"
You´ll get a kubecfg.p12 which you have to download from kubernetes master and install on your client (double-click, next, next, next - Chrome Browser is recommended).
cat <<EOF | kubectl create -f - apiVersion: v1 kind: ServiceAccount metadata: name: admin-user namespace: kube-system EOF
cat <<EOF | kubectl create -f - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: admin-user roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: admin-user namespace: kube-system EOF
kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
https://<master-ip>:<apiserver-port>/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy
, choose "Token" and put in the bearer token you´ll get from previous step and you´re done.Note: Information concering your cluster you´ll get via kubectl cluster-info
.