Is accessing kubernetes dashboard remotely possible

Question

Is accessing kubernetes dashboard remotely possible?

Hannah · Answer 1 · Nov 23, 2018

To access to Kubernetes Dashboard via proxy from remote machine, you will need to grant ClusterRole to allow access to dashboard.

Create new file and insert following details.

vi dashboard-access.yaml

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kube-dashboard
  labels:
    k8s-app: kube-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kube-dashboard
  namespace: kube-system

Now apply changes to Kubernetes Cluster to grant access to dashboard.

kubectl create -f dashboard-access.yaml

For further details, refer to the Kubernetes Course.

answered Nov 23, 2018 by Hannah
• 18,520 points

Ali · Answer 2 · Apr 26, 2019

As far as I know, I don't think it's possible to access the dashboard remotely. You can only access your dashboard from the master node.

answered Apr 26, 2019 by Vaidya

Yes it is possible by using NodePort instead of ClusterIP

[root@test ~]#   kubectl edit service kubernetes-dashboard -n kubernetes-dashboard

[root@test ~]# kubectl get services -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.108.130.235   <none>        8000/TCP        18h
kubernetes-dashboard        NodePort    10.110.166.162   <none>        443:31824/TCP   18h

https://192.168.1.128:31824/#/service?namespace=_all [Login Link]

commented Mar 9, 2020 by Ali
• 160 points

score +1 · Answer 3 · Apr 26, 2019

Kubernetes API server is exposed and accessible from outside you can directly access dashboard at:

https://<master-ip>:<apiserver-port>/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/

answered Apr 26, 2019 by Rick

score +1 · Answer 4 · May 3, 2019

It seems only the api request from localhost to the dashboard service can be accepted in proxy mode. Then the quest becomes how to make a request from a remote host look like from localhost of where the proxy is running (k8s master node, in my case).

Here are the steps:

1, deploy dashboard serive on master node:

kubectl apply -f

2, start proxy:
kubectl proxy&

3, create your own secret and obtain the token:
kubectl create serviceaccount <account name>
kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=default:<account name>
kubectl get secret
kubectl describe secret <secret name>

4, create ssh tunnel from a remote host outside of the cluster where you would access dashboard:
ssh -L 9999:127.0.0.1:8001 -N -f -l <user name> <k8s master host name or ip>
"-L" local port forwarding
"9999" is a local host port. it can be any available port. It can also be 8001
"127.0.0.1:8001" is where the proxy runs on k8s master host
Password may be required for the <user name> on the master host to create a tunnel
This command forwards any local request on port 9999 to"127.0.0.1:8001" on the master host

5, open a browser with the following api:
http://localhost:9999/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/

Then select "token" and past the token to log in the dashboard.

This approach does not require any addtional configuration in k8s cluster. It is recommended by Oracle: https://docs.oracle.com/cd/E52668_01/E88884/html/kube_admin_dashboard.html
Good luck.

answered May 3, 2019 by Ling

Hey @Ling, Thanks for such a nice explanation. I shall try it out. But could you please explain the third step? I do not understand why do we need to create a secret token?

commented May 3, 2019 by Tony

Thanks a lot. This comment helped me solve the issue.

commented Aug 21, 2019 by Vijay

Thanks a lot!!
This works like a charm, with a few caveats (easily fixed)

After:

kubectl describe secret <secret name>

issue

kubectl get svc --all-namespaces

To get the namespace the dashboard is running in.

The command that worked for me to open the tunnel is a simplified version of the original, run from a CMD window (the latest versions of Win10 now come with SSH).

ssh -L 9999:127.0.0.1:8001 -N <username>@<kubernetes-dashboard-host>

The link to access the dashboard needs to be adjusted:

http://localhost:9999/api/v1/namespaces/<dashboard-namespace>/services/https:kubernetes-dashboard:/proxy/

I'm working through "Hands-On Microservices with Kubernetes: Build, deploy, and manage scalable microservices on Kubernetes" by Gigi Sayfan

Reading the ebook in Windows 10, running Kubernetes in headless Ubuntu 18.04.
This instructions allowed me to access the dashboard from my browser in Win10.

commented Apr 7, 2020 by jpjofre

Ali · Answer 5 · Mar 9, 2020

Yes it is possible by using NodePort instead of ClusterIP

[root@test ~]#   kubectl edit service kubernetes-dashboard -n kubernetes-dashboard

[root@test ~]# kubectl get services -n kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.108.130.235   <none>        8000/TCP        18h
kubernetes-dashboard        NodePort    10.110.166.162   <none>        443:31824/TCP   18h

https://192.168.1.128:31824/#/service?namespace=_all [Login Link]