How To Create Admin User to Access Kubernetes Dashboard

Posted on 141 views

Kubernetes dashboard is a web based user interface for deploying containerized applications to a Kubernetes cluster – Deployments, Jobs, StatefulSets, DaemonSets e.t.c, and managing cluster resources while being able to troubleshoot issues that may arise. You can use the Dashboard to get an overview of applications running on your cluster.

Check our guide below on how to deploy Kubernetes dashboard:

This guide will discuss how you can create an admin user who has access to all Kubernetes resources. The admin user can modify objects in all namespaces as well as administer any other components in a cluster.

Step 1: Create Admin service account

Let’s start by creating a Service Account manifest file. I’ll name the service account jmutai-admin.

$ vim admin-sa.yml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jmutai-admin
  namespace: kube-system

Where jmutai-admin is the name of the service account to be created.

After creating a file, apply the manifest to create objects in your kubernetes cluster.

$ kubectl apply -f admin-sa.yml
serviceaccount/jmutai-admin created
clusterrolebinding.rbac.authorization.k8s.io/jmutai-admin created

Step 2: Create a Cluster Role Binding

Next is to assign the service account created a cluster role binding of cluster-admin.

$ vim admin-rbac.yml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jmutai-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: jmutai-admin
    namespace: kube-system

Replace jmutai-admin with the name of the service account you created in step 1.

Apply the file.

kubectl apply -f admin-rbac.yml

Step 3: Obtain admin user token

You can print the generated token for a service account by using the kubectl command.

Set a variable to store the name of the service account.

SA_NAME="jmutai-admin"

Then run the command below to print the token for the admin user created.

kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep $SA_NAME | awk 'print $1')

Output:

Name:         jmutai-admin-token-mm9jd
Namespace:    kube-system
Labels:       
Annotations:  kubernetes.io/service-account.name: jmutai-admin
              kubernetes.io/service-account.uid: 80fade4b-4270-11ea-9fe4-005056ba45bd

Type:  kubernetes.io/service-account-token

Data
====
token:      eyJhbGciOiJSUzI1NiIsImtpZCI9IiJ9.eyJpc7MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUxOiJqa211dGFpLWFkbWluLXRva2VuLW1tOWpkIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImprbXV0YWktYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI4MGZhZGU0Yi00MjcwLTExZWEtOWZlNC0wMDUwNTZiYTQ1YmQiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06amttdXRhaS1hZG1pbiJ9.uMC2ydeHF4jVA5tnKFbBeHRvc4NWqL920jigk2FDeduUdBuFhsNyDcscmL-pBbWHG5KKwOAEuAAeyNaknaHsDadNnbLpp4AMZTTdr22FEp-_v7MfIEQm3QWmq-c0ykpdrzUzGmk5Q3JIpfqeorDI0lZd52-DF4IVMw3VtTNp6ZMHdieQUNRnCEyfs98raCTRAotiXZQaMvmRW5s9peu5hfxM71jufg-Qzmflr9nO-dY2dOHh1WZcKhJqfNfB73GYX2TQlUlurV4Oy0-2CpUUpJ1HAjcSHzKGuSrMUAMAhRwhbZZXhwvbQ6Ei_9Vv2PkD8_Pw9c-k9x-bblFSAqyFhA
ca.crt:     1025 bytes
namespace:  11 bytes

Copy the contents in token key.

Step 4: Accessing Kubernetes Dashboard

Once the token is created, you can access your Kubernetes Dashboard with it. If using the NodePort to access dashboard service, you can obtain port allocated by issuing the command.

$ kubectl get services -n  | grep dashboard
kubernetes-dashboard   NodePort    10.111.76.69            443:32254/TCP                   414d

For me I will access the Kubernetes dashboard on any cluster machine IP address on port 32254.

access-kubernetes-dashboard-01

Select Token authentication type and paste your token to access the dashboard.

access-kubernetes-dashboard-02-1024x567

Step 5: Creating non admin user account

We created an admin user account which has full access to cluster resources. If you would like to grant users access with limit to the namespace, refer to our previous guide below.

coffee

Gravatar Image
A systems engineer with excellent skills in systems administration, cloud computing, systems deployment, virtualization, containers, and a certified ethical hacker.