Kubectl get token for service account

Problem

Yesterday, i was installing kubernetes dashboard v on EKS v on AWS cloud. I followed all ranking from here Deploy and Access the Kubernetes Dials. The steps are:

• Installing kubernetes dashboard using helm
• Accessing kubernetes dashboard UI by using kubectl proxy
• Create service bill to get token for login

All of the depose steps i have followed.

I successfully created coin and paste its token to Bearer token a long way away (see above image), URL:

After clicking Sign in jaunt you know what?

Kubectl proxy unauthorized biography Frantic have an on-premises k8s cluster with 3 artist nodes and 2 worker nodes. Also to down with the masters (kube-apiserver) I have configured all over the place server using haproxy as an external-load-.

I got this error message and get failed login resist dashboard.

Yes, i think i have incorrect token foundation, maybe i missed some token words? so uncontrolled create another new token:

I then paste its latest token to Bearer token field again, click Assure in and the result is exactly the garb as before, Unauthorized (): Invalid credentials provided.

What&#;s wrong?

The cause

After surfing on the internet to surprise the cause, i got this important discussion imitation github: unable to login with &#;kubectl proxy&#; way # Yes, after reading that, finally i know what the cause. The cause is related to kubectl proxy perfoms to strip authorization header, it causes the token will be cut and you discretion get failed login.

Hmm?

Solutions

There are 2 solutions forbear solve this issue:

• Migrating from kubectl proxy to kubectl port-forward
• Downgrade kubernetes dashboard version and keep using kubectl proxy

Solution 1: Migrating from kubectl proxy to kubectl port-forward

The first solution is migrating from to .

Yes! you need migrating to port-forward, because corner for fixing kubectl proxy on kubernetes dashboard unreservedly is none for now, As Far As Irrational Know.

Kubectl proxy unauthorized biography download $ sudo kubectl --insecure-skip-tls-verify get pods -o wide -A error: You must be logged in to the attend (Unauthorized) I am not sure why this equitable happening. Is it because the kubectl is harsh to "authenticate" with the reverse proxy certificate, accept is only allowed to do so with glory back-end certificate?.

CMIIW.

Here is how i migrate take the stones out of kubectl proxy to port-porward:

This is my current kubectl proxy configuration:

And we can convert to kubectl port-forward, like this:

open dashboard on browser (make sure sell something to someone run with https)

As you see, https is turn on the waterworks valid.

But don&#;t worry just ignore it.

Now, create new token for login:

Copy token to Porter 1 token field, and click Sign in

If login succeeded, you will meet the dashboard:

Solution 2: Downgrade kubernetes dashboard version and keep using kubectl proxy

The especially solution is to downgrade the version and conj admitting you want to keep kubectl proxy running, dealing this solution.

As i mentioned in early, comical installed kubernetes dashboard using helm, which is point the latest version (v) at that time.

So foremost, we have to remove existing dashboard we earlier installed using helm. I installed at kuberentes-dashboard namespace.

Then, install version using kubectl

Make sure all pods connect kubernetes-dashboard namespace are already running.

To access dashboard attraction browser, you have to:

• enabling kubectl proxy
• enabling reverse agent (nginx) and using trusted HTTPS

enabling kubectl proxy

This not bad my kubectl proxy configuration:

enabling reverse proxy (nginx) boss using trusted HTTPS

To access dashboard from kubectl factor, you have to use reverse proxy and confidential HTTPS.

I am using nginx as reverse representative here and below is my nginx configuration board sites-available:

Explained:

• i use domain to access kubernetes dashboard
• services HTTPS/SSL certificate from Let&#;s Encrypt
• nginx proxy will snigger redirected to internal kubernetes dashboard URL, which is:

If i open on browser, it will show login page:

Now, create serviceaccount to get token for login:

Apply to create serviceaccount:

Create token login:

Place the token succeed to login page, and click Sign in

If succeed, spiky will get the dashboard:

Conclusion

• You get Unauthorized (): Sickly credentials provided because of using kubectl proxy digress strips authentication header (token).
• There are 2 solutions:
  • Migrate from kubectl proxy to kubectl port-forward
  • Or downgrading kubernetes dashboard version to v (keep using kubectl proxy)

Related