Kubernetes Dashboard - Enable user authentication [ Step by step ]

Would you like to learn how to install the Kubernetes Dashboard and enable user authentication? In this tutorial, we are going to show you how to install the Kubernetes Dashboard and enable the authentication using the username and password on a computer running Ubuntu Linux.

• Ubuntu 20
• Ubuntu 19
• Ubuntu 18
• Kubernetes 1.18

This tutorial assumes that you have a Kubernetes master node installed.

In our example, The Kubernetes node IP address is 192.168.15.200.

Kubernetes - Tutorials

On this page, we offer quick access to a list of tutorials related to Kubernetes.

Tutorial Kubernetes Dashboard - Enable user authentication

Install the list of required packages.

Copy to Clipboard

Download the required YAML file.

Copy to Clipboard

Edit this YAML file.

Copy to Clipboard

Locate the area named DEPLOYMENT and add the following configuration.

Copy to Clipboard

Here is the DEPLOYMENT area, before our configuration.

Copy to Clipboard

Here is the DEPLOYMENT area, after our configuration.

Copy to Clipboard

Install the required Kubernetes Dashboard configuration.

Copy to Clipboard

Here is the command output.

Copy to Clipboard

Create the Kubernetes Dashboard password file.

Copy to Clipboard

Here is the file content.

Copy to Clipboard

In our example, we created a user account named ADMIN and configured the password ADMINPASS123.

Edit the Kubernetes API configuration file.

Copy to Clipboard

Locate the area named VOLUMES and add the following configuration.

Copy to Clipboard

Here is the VOLUMES area, before our configuration.

Copy to Clipboard

Here is the VOLUMES area, after our configuration.

Copy to Clipboard

Locate the area named VOLUMEMOUNTS and add the following configuration.

Copy to Clipboard

Here is the VOLUMEMOUNTS area, before our configuration.

Copy to Clipboard

Here is the VOLUMEMOUNTS area, after our configuration.

Copy to Clipboard

Locate the area named COMMAND and add the following configuration.

Copy to Clipboard

Here is the COMMAND area, before our configuration.

Copy to Clipboard

spec:
  containers:
  - command:
    - kube-apiserver
    - --advertise-address=192.168.15.200
    - --allow-privileged=true
    - --authorization-mode=Node,RBAC
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --enable-admission-plugins=NodeRestriction
    - --enable-bootstrap-token-auth=true
    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
    - --etcd-servers=https://127.0.0.1:2379
    - --insecure-port=0
    - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
    - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
    - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
    - --requestheader-allowed-names=front-proxy-client
    - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
    - --requestheader-extra-headers-prefix=X-Remote-Extra-
    - --requestheader-group-headers=X-Remote-Group
    - --requestheader-username-headers=X-Remote-User
    - --secure-port=6443
    - --service-account-key-file=/etc/kubernetes/pki/sa.pub
    - --service-cluster-ip-range=10.96.0.0/12
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key

Here is the COMMAND area, after our configuration.

Copy to Clipboard

spec:
  containers:
  - command:
    - kube-apiserver
    - --advertise-address=192.168.15.200
    - --allow-privileged=true
    - --authorization-mode=Node,RBAC
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --enable-admission-plugins=NodeRestriction
    - --enable-bootstrap-token-auth=true
    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
    - --etcd-servers=https://127.0.0.1:2379
    - --insecure-port=0
    - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
    - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
    - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
    - --requestheader-allowed-names=front-proxy-client
    - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
    - --requestheader-extra-headers-prefix=X-Remote-Extra-
    - --requestheader-group-headers=X-Remote-Group
    - --requestheader-username-headers=X-Remote-User
    - --secure-port=6443
    - --service-account-key-file=/etc/kubernetes/pki/sa.pub
    - --service-cluster-ip-range=10.96.0.0/12
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    - --basic-auth-file=/etc/kubernetes/auth/auth.csv

After changing the Kubernetes API configuration file, the system will automatically delete the PODs using the older configuration.

The system will also generate new PODs using the new configuration.

This can take between 1 and 5 minutes.

You can monitor the Syslog file to verify this process.

Copy to Clipboard

Wait for this process to finish.

Start the proxy to enable access to the Kubernetes Dashboard.

Copy to Clipboard

Important! Access to the Kubernetes dashboard over HTTP is only allowed to the Localhost.

If this computer has a graphical interface, open your browser and access the following URL:

• http://127.0.0.1:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/

The Kubernetes Dashboard login interface should be displayed.

Select the Basic option and enter the username and password previously created.

• Username: admin
• Password: adminpass123

After a successful login, the Kubernetes Dashboard should be presented.

You have finished the Kubernetes Dashboard configuration to use the Basic authentication.

Kubernetes Dashboard - Remote access using Apache proxy

Access to the Kubernetes dashboard over HTTP is only allowed to the Localhost.

Let's use Apache as a proxy to allow remote access on the Kubernetes Dashboard.

On the Master node, install the Apache server.

Copy to Clipboard

Enable the required Apache modules.

Copy to Clipboard

Edit the Apache configuration file.

Copy to Clipboard

Add the following lines at the end of this file.

Copy to Clipboard

Create a private key and the certificate using the OpenSSL command.

Copy to Clipboard

Enter the requested information.

Copy to Clipboard

On the option named COMMON_NAME, you need to enter the IP address or hostname.

In our example, we used the IP address: 192.168.15.200

Edit the Apache configuration file for the default website.

Copy to Clipboard

Here is the file, before our configuration.

Copy to Clipboard

Here is the file, after our configuration.

Copy to Clipboard

In our example, we redirected HTTP users to the HTTPS version of the website.

In our example, the Apache server will work as a proxy and send all requests to the Kubernetes proxy.

In our example, we used self-signed certificates.

Restart the Apache service.

Copy to Clipboard

Start the proxy to enable access to the Kubernetes Dashboard.

Copy to Clipboard

Open your browser and enter the IP address of your web server.

In our example, the following URL was entered in the Browser:

• https://192.168.15.200/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/#/login

The Apache server will work as a proxy and display the Kubernetes Dashboard.

Select the Basic option and enter the username and password previously created.

• Username: admin
• Password: adminpass123

After a successful login, the Kubernetes Dashboard should be presented.

Congratulations! You successfully finished the configuration of Apache as a proxy to the Kubernetes Dashboard.

Kubernetes Dashboard - Enable user authentication