{"id":45715,"date":"2020-01-29T22:48:10","date_gmt":"2020-01-29T19:48:10","guid":{"rendered":"https:\/\/computingforgeeks.com\/?p=45715"},"modified":"2024-04-13T10:11:21","modified_gmt":"2024-04-13T07:11:21","slug":"create-admin-user-to-access-kubernetes-dashboard","status":"publish","type":"post","link":"https:\/\/computingforgeeks.com\/create-admin-user-to-access-kubernetes-dashboard\/","title":{"rendered":"Creating Kubernetes Admin User for Accessing Dashboard"},"content":{"rendered":"\n<p>Kubernetes dashboard is a web based user interface for deploying containerized applications to a Kubernetes cluster &#8211; Deployments, Jobs, StatefulSets, DaemonSets e.t.c, and managing cluster resources while being able to troubleshoot issues that may arise. You can use the Dashboard to get an overview of applications running on your cluster.<\/p>\n\n\n\n<p>Check our guide below on how to deploy Kubernetes dashboard:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/computingforgeeks.com\/how-to-install-kubernetes-dashboard-with-nodeport\/\" target=\"_blank\" rel=\"noreferrer noopener\">How To Install Kubernetes Dashboard with NodePort<\/a><\/li>\n<\/ul>\n\n\n\n<p>This guide will discuss how you can create an admin user who has access to all Kubernetes resources. The admin user can modify objects in all namespaces as well as administer any other components in a cluster.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Create Admin service account<\/h2>\n\n\n\n<p>Let&#8217;s start by creating a Service Account manifest file. I&#8217;ll name the service account <strong><em>k8sadmin<\/em><\/strong>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\">vim admin-sa.yml<\/mark>\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-purple-color\">k8sadmin<\/mark>\n  namespace: kube-system<\/code><\/pre>\n\n\n\n<p>Where <strong>k8sadmin <\/strong>is the name of the service account to be created.<\/p>\n\n\n\n<p>After creating a file, apply the manifest to create objects in your kubernetes cluster.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\"> kubectl apply -f admin-sa.yml<\/mark>\nserviceaccount\/k8sadmin created\nclusterrolebinding.rbac.authorization.k8s.io\/k8sadmin created<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Create a Cluster Role Binding<\/h2>\n\n\n\n<p>Next is to assign the service account created a cluster role binding of <strong>cluster-admin.<\/strong> <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\">vim admin-rbac.yml<\/mark>\n---\napiVersion: rbac.authorization.k8s.io\/v1\nkind: ClusterRoleBinding\nmetadata:\n  namespace: kube-system\n  name: <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-purple-color\">k8sadmin<\/mark>\nroleRef:\n  apiGroup: rbac.authorization.k8s.io\n  kind: ClusterRole\n  name: cluster-admin\nsubjects:\n  - kind: ServiceAccount\n    name: <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-purple-color\">k8sadmin<\/mark>\n    namespace: kube-system<\/code><\/pre>\n\n\n\n<p>Replace <strong>k8sadmin <\/strong>with the name of the service account you created in step 1.<\/p>\n\n\n\n<p>Apply the file.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl apply -f admin-rbac.yml<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Obtain admin user token<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Kubernetes &lt;=1.23.<\/h3>\n\n\n\n<p>You can print the generated token for a service account by using the <strong>kubectl <\/strong>command.<\/p>\n\n\n\n<p>Set a variable to store the name of the service account.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SA_NAME=\"<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-purple-color\">k8sadmin<\/mark>\"<\/code><\/pre>\n\n\n\n<p>Then run the command below to print the token for the admin user created.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep ${SA_NAME} | awk '{print $1}')<\/code><\/pre>\n\n\n\n<p>Output:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Name:        k8sadmin-token-mm9jd\nNamespace:    kube-system\nLabels:       &lt;none&gt;\nAnnotations:  kubernetes.io\/service-account.name: k8sadmin\n              kubernetes.io\/service-account.uid: 80fade4b-4270-11ea-9fe4-005056ba45bd\n\nType:  kubernetes.io\/service-account-token\n\nData\n====\ntoken:      eyJhbGciOiJSUzI1NiIsImtpZCI9IiJ9.eyJpc7MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUxOiJqa211dGFpLWFkbWluLXRva2VuLW1tOWpkIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImprbXV0YWktYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI4MGZhZGU0Yi00MjcwLTExZWEtOWZlNC0wMDUwNTZiYTQ1YmQiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06amttdXRhaS1hZG1pbiJ9.uMC2ydeHF4jVA5tnKFbBeHRvc4NWqL920jigk2FDeduUdBuFhsNyDcscmL-pBbWHG5KKwOAEuAAeyNaknaHsDadNnbLpp4AMZTTdr22FEp-_v7MfIEQm3QWmq-c0ykpdrzUzGmk5Q3JIpfqeorDI0lZd52-DF4IVMw3VtTNp6ZMHdieQUNRnCEyfs98raCTRAotiXZQaMvmRW5s9peu5hfxM71jufg-Qzmflr9nO-dY2dOHh1WZcKhJqfNfB73GYX2TQlUlurV4Oy0-2CpUUpJ1HAjcSHzKGuSrMUAMAhRwhbZZXhwvbQ6Ei_9Vv2PkD8_Pw9c-k9x-bblFSAqyFhA\nca.crt:     1025 bytes\nnamespace:  11 bytes<\/code><\/pre>\n\n\n\n<p>Copy the contents in <strong>token<\/strong> key.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Kubernetes &gt;=1.24<\/h3>\n\n\n\n<p>From Kubernetes <strong><em>1.24<\/em><\/strong> on, the <a href=\"https:\/\/github.com\/kubernetes\/kubernetes\/blob\/master\/CHANGELOG\/CHANGELOG-1.24.md#urgent-upgrade-notes\" target=\"_blank\" rel=\"noreferrer noopener\">token is not automatically created anymore<\/a>. We&#8217;ll instead use TokenRequest API to create tokens.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl create token <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-purple-color\">k8sadmin<\/mark><\/code><\/pre>\n\n\n\n<p>Sample output:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>eyJhbGciOiJSUzI1NiIsImtpZCI6ImkyWUh6N01DaW9OUG40Uzk0NVVRdlZoZWV0TzQ5cTNOd21UcFQxdE5ud0UifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLms4cy5jbG91ZGxhYnNrZS5pbyJdLCJleHAiOjE2Nzg0NTY3MjEsImlhdCI6MTY3ODQ1MzEyMSwiaXNzIjoiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLms4cy5jbG91ZGxhYnNrZS5pbyIsImt1YmVybmV0ZXMuaW8iOnsibmFtZXNwYWNlIjoia3ViZS1zeXN0ZW0iLCJzZXJ2aWNlYWNjb3VudCI6eyJuYW1lIjoiamttdXRhaS1hZG1pbiIsInVpZCI6IjQxNGEzMDZkLTU3MjgtNGE3ZS1iZjhhLTdlNjZjNzc0M2I4OSJ9fSwibmJmIjoxNjc4NDUzMTIxLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06amttdXRhaS1hZG1pbiJ9.MnKpsXpj2xQcqJtx-KTrqpTnQ3l79jhjdHEjtSHvjV4F-Fkvj3YpqqfqQHmN5_WNKxrgxQNdbUEVLjBJmhYYrZEOiGRdtb7s5XKA6C4eY-mGr59UZvdNWyILHfoDCi8YT8IyUdu6wpAO_6zdHHh95F2g7mM0QZAgVHT5RR3hPCDRrUpYm1ZiDUohg-A6RnnSoDXKpHQ4Y9v_HQZWufdldfQ0XYwI47nDnKkimLyTcn-n9hWMBbUh6x79paL0Jf0QfBoFRtrzWlDMhyhPPxEehgwo8Qdmplz1vA6trBUl52gEz0E9iVyGsMz3bKhbk_-F-raTYhHlJx2iqdmnnON0uw<\/code><\/pre>\n\n\n\n<p>To create a secret create a file.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-pale-pink-color\">vim k8sadmin-secret.yaml<\/mark>\napiVersion: v1\nkind: Secret\nmetadata:\n  name: <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-light-green-cyan-color\">k8sadmin-token<\/mark>\n  annotations:\n    kubernetes.io\/service-account.name: <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-purple-color\">k8sadmin<\/mark>\ntype: kubernetes.io\/service-account-token<\/code><\/pre>\n\n\n\n<p>Create object in kubernetes<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl apply -f k8sadmin-secret.yaml<\/code><\/pre>\n\n\n\n<p>You can then print the token.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>export NAMESPACE=\"<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-cyan-blue-color\">kube-system<\/mark>\"\nexport K8S_USER=\"<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-purple-color\">k8sadmin<\/mark>\"\nkubectl -n ${NAMESPACE} describe secret $(kubectl -n ${NAMESPACE} get secret | (grep ${K8S_USER} || echo \"$_\") | awk '{print $1}') | grep token: | awk '{print $2}'\\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Accessing Kubernetes Dashboard<\/h2>\n\n\n\n<p>Once the token is created, you can access your Kubernetes Dashboard with it. If using the <em>NodePort<\/em> to access dashboard service, you can obtain port allocated by issuing the command.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ <span class=\"has-inline-color has-luminous-vivid-amber-color\">kubectl get services -n &lt;namespace&gt; | grep dashboard<\/span>\nkubernetes-dashboard   NodePort    10.111.76.69    &lt;none&gt;        443:32254\/TCP                   414d<\/code><\/pre>\n\n\n\n<p>For me I will access the Kubernetes dashboard on any cluster machine IP address on port <strong>32254.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"909\" height=\"558\" src=\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-01.png\" alt=\"\" class=\"wp-image-45728\" title=\"\" srcset=\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-01.png 909w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-01-300x184.png 300w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-01-768x471.png 768w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-01-696x427.png 696w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-01-684x420.png 684w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-01-356x220.png 356w\" sizes=\"auto, (max-width: 909px) 100vw, 909px\" \/><\/figure>\n\n\n\n<p>Select <strong>Token<\/strong> authentication type and paste your token to access the dashboard.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large td-caption-align-https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-02.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"567\" src=\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-02-1024x567.png\" alt=\"\" class=\"wp-image-45731\" title=\"\" srcset=\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-02-1024x567.png 1024w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-02-300x166.png 300w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-02-768x425.png 768w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-02-696x385.png 696w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-02-1068x591.png 1068w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-02-758x420.png 758w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/access-kubernetes-dashboard-02.png 1367w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Creating non admin user account<\/h2>\n\n\n\n<p>We created an admin user account which has full access to cluster resources. If you would like to grant users access with limit to the namespace, refer to our previous guide below.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a aria-label=\" (opens in a new tab)\" rel=\"noreferrer noopener\" href=\"https:\/\/computingforgeeks.com\/restrict-kubernetes-service-account-users-to-a-namespace-with-rbac\/\" target=\"_blank\">Create Kubernetes Service \/ User Account restricted to one Namespace<\/a><\/li>\n<\/ul>\n\n\n\n<p>More guides on Kubernetes and containers:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/computingforgeeks.com\/minimal-container-operating-systems-for-kubernetes\/\" target=\"_blank\" rel=\"noreferrer noopener\">Top Minimal Container Operating Systems for running Kubernetes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/computingforgeeks.com\/join-new-kubernetes-worker-node-to-existing-cluster\/\" target=\"_blank\" rel=\"noreferrer noopener\">Join new Kubernetes Worker Node to an existing Cluster<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/computingforgeeks.com\/how-to-deploy-metrics-server-to-kubernetes-cluster\/\" target=\"_blank\" rel=\"noreferrer noopener\">How To Deploy Metrics Server to Kubernetes Cluster<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/computingforgeeks.com\/install-and-use-helm-3-on-kubernetes-cluster\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install and Use Helm 3 on Kubernetes Cluster<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/computingforgeeks.com\/docker-vs-cri-o-vs-containerd\/\" target=\"_blank\" rel=\"noreferrer noopener\">Docker vs CRI-O vs Containerd<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Kubernetes dashboard is a web based user interface for deploying containerized applications to a Kubernetes cluster &#8211; Deployments, Jobs, StatefulSets, DaemonSets e.t.c, and managing cluster resources while being able to troubleshoot issues that may arise. You can use the Dashboard to get an overview of applications running on your cluster. Check our guide below on &#8230; <a title=\"Creating Kubernetes Admin User for Accessing Dashboard\" class=\"read-more\" href=\"https:\/\/computingforgeeks.com\/create-admin-user-to-access-kubernetes-dashboard\/\" aria-label=\"Read more about Creating Kubernetes Admin User for Accessing Dashboard\">Read more<\/a><\/p>\n","protected":false},"author":3,"featured_media":45731,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[50,316,299,317],"tags":[218,217,318],"class_list":["post-45715","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-tutorials","category-containers","category-how-to","category-kubernetes","tag-containers","tag-docker","tag-kubernetes"],"_links":{"self":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/45715","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/comments?post=45715"}],"version-history":[{"count":0,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/45715\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/media\/45731"}],"wp:attachment":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/media?parent=45715"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/categories?post=45715"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/tags?post=45715"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}