Question

Is accessing kubernetes dashboard remotely possible?

Answer 1

To access to Kubernetes Dashboard via proxy from remote machine, you will need to grant ClusterRole to allow access to dashboard.

Create new file and insert following details.

vi dashboard-access.yaml

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kube-dashboard
  labels:
    k8s-app: kube-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kube-dashboard
  namespace: kube-system

Now apply changes to Kubernetes Cluster to grant access to dashboard.

kubectl create -f dashboard-access.yaml

For further details, refer to the Kubernetes Course.

Answer 2

As far as I know, I don't think it's possible to access the dashboard remotely. You can only access your dashboard from the master node.

Comments

Yes it is possible by using NodePort instead of ClusterIP

[root@test ~]#   kubectl  edit service kubernetes-dashboard -n kubernetes-dashboard

[root@test ~]# kubectl get services -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.108.130.235   <none>        8000/TCP        18h
kubernetes-dashboard        NodePort    10.110.166.162   <none>        443:31824/TCP   18h

https://192.168.1.128:31824/#/service?namespace=_all [Login Link]

Answer 3

Kubernetes API server is exposed and accessible from outside you can directly access dashboard at: 

https://<master-ip>:<apiserver-port>/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/

Answer 4

It seems only the api request from localhost to the dashboard service can be accepted in proxy mode. Then the quest becomes how to make a request from a remote host look like from localhost of where the proxy is running (k8s master node, in my case).

Here are the steps:

1,  deploy dashboard serive on master node:

kubectl apply -f  2, start proxy:  kubectl proxy& 3, create your own secret and obtain the token: kubectl create serviceaccount <account name> kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=default:<account name> kubectl get secret kubectl describe secret <secret name> 4, create ssh tunnel from a remote host outside of the cluster where you would access dashboard: ssh -L 9999:127.0.0.1:8001 -N -f -l <user name> <k8s master host name or ip> "-L" local port forwarding "9999" is a local host port. it can be any available port. It can also be 8001 "127.0.0.1:8001" is where the proxy runs on k8s master host Password may be required for the <user name> on the master host to create a tunnel This command forwards any local request on port 9999 to"127.0.0.1:8001" on the master host 5, open a browser with the following api: http://localhost:9999/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/ Then select "token" and past the token to log in the dashboard. This approach does not require any addtional configuration in k8s cluster. It is recommended by Oracle: https://docs.oracle.com/cd/E52668_01/E88884/html/kube_admin_dashboard.html Good luck.

Comments

Hey @Ling, Thanks for such a nice explanation. I shall try it out. But could you please explain the third step? I do not understand why do we need to create a secret token?

---

Thanks a lot. This comment helped me solve the issue.

---

Thanks a lot!!
This works like a charm, with a few caveats (easily fixed)

After:

kubectl describe secret <secret name>

issue

kubectl get svc --all-namespaces

To get the namespace the dashboard is running in.

The command that worked for me to open the tunnel is a simplified version of the original, run from a CMD window (the latest versions of Win10 now come with SSH).

ssh -L 9999:127.0.0.1:8001 -N <username>@<kubernetes-dashboard-host>

The link to access the dashboard needs to be adjusted:

http://localhost:9999/api/v1/namespaces/<dashboard-namespace>/services/https:kubernetes-dashboard:/proxy/

I'm working through "Hands-On Microservices with Kubernetes: Build, deploy, and manage scalable microservices on Kubernetes" by Gigi Sayfan

Reading the ebook in Windows 10, running Kubernetes in headless Ubuntu 18.04.
This instructions allowed me to access the dashboard from my browser in Win10.

Answer 5

Yes it is possible by using NodePort instead of ClusterIP

[root@test ~]#   kubectl  edit service kubernetes-dashboard -n kubernetes-dashboard

[root@test ~]# kubectl get services -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.108.130.235   <none>        8000/TCP        18h
kubernetes-dashboard        NodePort    10.110.166.162   <none>        443:31824/TCP   18h

https://192.168.1.128:31824/#/service?namespace=_all [Login Link]