{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/dashboard/issues/574","repository_url":"https://api.github.com/repos/kubernetes/dashboard","labels_url":"https://api.github.com/repos/kubernetes/dashboard/issues/574/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/dashboard/issues/574/comments","events_url":"https://api.github.com/repos/kubernetes/dashboard/issues/574/events","html_url":"https://github.com/kubernetes/dashboard/issues/574","id":143387316,"number":574,"title":"Authentication guidelines","user":{"login":"cescoferraro","id":6259987,"avatar_url":"https://avatars.githubusercontent.com/u/6259987?v=3","gravatar_id":"","url":"https://api.github.com/users/cescoferraro","html_url":"https://github.com/cescoferraro","followers_url":"https://api.github.com/users/cescoferraro/followers","following_url":"https://api.github.com/users/cescoferraro/following{/other_user}","gists_url":"https://api.github.com/users/cescoferraro/gists{/gist_id}","starred_url":"https://api.github.com/users/cescoferraro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cescoferraro/subscriptions","organizations_url":"https://api.github.com/users/cescoferraro/orgs","repos_url":"https://api.github.com/users/cescoferraro/repos","events_url":"https://api.github.com/users/cescoferraro/events{/privacy}","received_events_url":"https://api.github.com/users/cescoferraro/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/dashboard/labels/area/docs","name":"area/docs","color":"fad8c7"},{"url":"https://api.github.com/repos/kubernetes/dashboard/labels/kind/enhancement","name":"kind/enhancement","color":"207de5"},{"url":"https://api.github.com/repos/kubernetes/dashboard/labels/priority/P2","name":"priority/P2","color":"fbca04"}],"state":"open","locked":false,"assignee":{"login":"bryk","id":1159999,"avatar_url":"https://avatars.githubusercontent.com/u/1159999?v=3","gravatar_id":"","url":"https://api.github.com/users/bryk","html_url":"https://github.com/bryk","followers_url":"https://api.github.com/users/bryk/followers","following_url":"https://api.github.com/users/bryk/following{/other_user}","gists_url":"https://api.github.com/users/bryk/gists{/gist_id}","starred_url":"https://api.github.com/users/bryk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bryk/subscriptions","organizations_url":"https://api.github.com/users/bryk/orgs","repos_url":"https://api.github.com/users/bryk/repos","events_url":"https://api.github.com/users/bryk/events{/privacy}","received_events_url":"https://api.github.com/users/bryk/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/kubernetes/dashboard/milestones/2","html_url":"https://github.com/kubernetes/dashboard/milestones/v1.1","labels_url":"https://api.github.com/repos/kubernetes/dashboard/milestones/2/labels","id":1614345,"number":2,"title":"v1.1","description":"","creator":{"login":"bryk","id":1159999,"avatar_url":"https://avatars.githubusercontent.com/u/1159999?v=3","gravatar_id":"","url":"https://api.github.com/users/bryk","html_url":"https://github.com/bryk","followers_url":"https://api.github.com/users/bryk/followers","following_url":"https://api.github.com/users/bryk/following{/other_user}","gists_url":"https://api.github.com/users/bryk/gists{/gist_id}","starred_url":"https://api.github.com/users/bryk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bryk/subscriptions","organizations_url":"https://api.github.com/users/bryk/orgs","repos_url":"https://api.github.com/users/bryk/repos","events_url":"https://api.github.com/users/bryk/events{/privacy}","received_events_url":"https://api.github.com/users/bryk/received_events","type":"User","site_admin":false},"open_issues":15,"closed_issues":15,"state":"open","created_at":"2016-03-01T08:12:58Z","updated_at":"2016-05-19T12:41:15Z","due_on":"2016-05-25T22:00:00Z","closed_at":null},"comments":19,"created_at":"2016-03-24T23:28:10Z","updated_at":"2016-05-19T14:55:51Z","closed_at":null,"body":"#### Issue details\r\n\r\n##### Environment\r\n<!-- Describe how do you run Kubernetes and Dashboard. \r\n     Versions of Node.js, Go etc. are needed only from developers. To get them use console:\r\n     $ node --version\r\n     $ go version\r\n -->\r\n\r\n```\r\nDashboard version: kubernetes-dashboard-canary\r\nKubernetes version: v1.2\r\nOperating system: CoreOS 899 self hosted on Digital Ocean through Terraform\r\nGo version: go version go1.6 darwin/amd64\r\n```\r\n\r\n##### Steps to reproduce\r\ni am deploying this [kubernetes-dashboard-canary](https://github.com/kubernetes/dashboard/blob/master/src/deploy/kubernetes-dashboard-canary.yaml)\r\n\r\n\r\n##### Observed result\r\nusing the insecure port\r\n`- --apiserver-host=http://{{ .Env.MASTER_PRIVATE }}:8080`\r\nit works but I have no restriction to who access the dashboard.\r\n\r\nusing the secure port\r\n`- --apiserver-host=https://{{ .Env.MASTER_PRIVATE }}:6443`\r\ni get\r\n`Get https://10.134.19.15:6443/api/v1/replicationcontrollers: x509: failed to load system roots and no roots provided`\r\nas expected because the pod ip in not on the certificates I generated as the kube-apiserver confirms\r\n`Mar 24 22:59:32 master kube-apiserver[1298]: I0324 22:59:32.632002    1298 logs.go:41] http: TLS handshake error from 10.100.68.2:45592: remote error: bad certificate`\r\n\r\nI am using simple authentication to the api, I was expecting something like this for the dashboard as well. What the dashboard way of doing this?\r\nDo I have to build a new docker-image copying the certificates to /etc/kubernetes/ssl/??\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/dashboard/issues/comments/220349778","html_url":"https://github.com/kubernetes/dashboard/issues/574#issuecomment-220349778","issue_url":"https://api.github.com/repos/kubernetes/dashboard/issues/574","id":220349778,"user":{"login":"ManuelGysin","id":2873373,"avatar_url":"https://avatars.githubusercontent.com/u/2873373?v=3","gravatar_id":"","url":"https://api.github.com/users/ManuelGysin","html_url":"https://github.com/ManuelGysin","followers_url":"https://api.github.com/users/ManuelGysin/followers","following_url":"https://api.github.com/users/ManuelGysin/following{/other_user}","gists_url":"https://api.github.com/users/ManuelGysin/gists{/gist_id}","starred_url":"https://api.github.com/users/ManuelGysin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ManuelGysin/subscriptions","organizations_url":"https://api.github.com/users/ManuelGysin/orgs","repos_url":"https://api.github.com/users/ManuelGysin/repos","events_url":"https://api.github.com/users/ManuelGysin/events{/privacy}","received_events_url":"https://api.github.com/users/ManuelGysin/received_events","type":"User","site_admin":false},"created_at":"2016-05-19T14:55:51Z","updated_at":"2016-05-19T14:55:51Z","body":"I played a bit more around:\r\n\r\n``\r\nFROM gcr.io/google_containers/kubernetes-dashboard-amd64:canary\r\nADD ca.crt /etc/ssl/certs/ca-certificates.cr\r\n```\r\n\r\nAfter that I now get:\r\n\r\n```\r\nthe server has asked for the client to provide credentials (get replicationControllers)\r\n```\r\n\r\nkubectl describe pod kubernetes-dashboard-kmfyu --namespace=kube-system\r\n```\r\nVolumes:\r\n  default-token-7nsaq:\r\n    Type:       Secret (a volume populated by a Secret)\r\n    SecretName: default-token-7nsaq\r\n```\r\n\r\nSecrets are mounted to ```/var/run/secrets/kubernetes.io/serviceaccount```.\r\nI can access the token without problems.\r\n\r\nIf I run curl in the container:\r\n\r\n```\r\ncurl -k -H \"Authorization: Bearer $TOKEN_VALUE\" https://host:443\r\n{\r\n  \"paths\": [\r\n    \"/api\",\r\n    \"/api/v1\",\r\n    \"/apis\",\r\n    \"/apis/autoscaling\",\r\n    \"/apis/autoscaling/v1\",\r\n    \"/apis/batch\",\r\n    \"/apis/batch/v1\",\r\n    \"/apis/extensions\",\r\n    \"/apis/extensions/v1beta1\",\r\n    \"/healthz\",\r\n    \"/healthz/ping\",\r\n    \"/logs/\",\r\n    \"/metrics\",\r\n    \"/resetMetrics\",\r\n    \"/swagger-ui/\",\r\n    \"/swaggerapi/\",\r\n    \"/ui/\",\r\n    \"/version\"\r\n  ]\r\n}\r\n```\r\n\r\nSo everything should be setup right? But why dashboard can not connect to the API?"}}