<p>I am fairly new to kubernetes and I am trying to create normal users that will have limited access to their specific namespace.</p>
<p>I have followed the documentation <a href="https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#normal-user" rel="nofollow noreferrer">Certificate Signing Requests/Normal user</a> and I have successfully create a test-user and I am able to restrict the privileges of the user. I am trying to understand if I can provide access to the Dashboard for this user and only being able to see his own resources e.g. only his namespace.</p>
<p>Through my process I found all the documentation mentioning that you need to have a service account in order to access the Dashboard <a href="https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md" rel="nofollow noreferrer">Creating sample user</a>.</p>
<p>Then I kept reading that service accounts <a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#:%7E:text=User%20accounts%20versus%20service%20accounts,are%20intended%20to%20be%20global." rel="nofollow noreferrer">Managing Service Accounts</a>. <em>&quot;User accounts are for humans. Service accounts are for processes, which run in pods.&quot;</em></p>
<p>In a relevant question in the community <a href="https://stackoverflow.com/questions/48022748/is-there-a-way-to-create-a-token-for-a-normal-user-in-kubernetes">Is there a way to create a token for a normal user in Kubernetes?</a>. Again the answer to this question was to create a service account, but as it is documented on the official documentation we should be using service accounts for processes that are running on pods.</p>
<p>I am a bit confused on this topic can someone share the best practices and maybe a bit more information if a user (non admin) should be able to have access to Dashboard and view the same resources as unde the role binded with him?</p>

<p>The most common way to create <code>bearer token</code> and connect to <code>Kubernetes Dashboard</code> is to use <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">ServiceAccount</a>.</p>
<p>However, if you want to create <code>Bearer Token</code> for <code>User Account</code> you have to use <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#static-token-file" rel="nofollow noreferrer">Static Token File</a> according to my knowledge.</p>
<p>In scenario, where you want to allow <code>user account</code> access to <code>Kubernetes Dashboard</code> you have to consider using <a href="https://github.com/kubernetes/dashboard/tree/master/docs/user/access-control#authorization-header" rel="nofollow noreferrer">Authorization header</a> option.</p>
<blockquote>
<p>Using authorization header is the only way to make Dashboard act as an user, when accessing it over HTTP. Note that there are some risks since plain HTTP traffic is vulnerable to MITM attacks.</p>
<p>To make Dashboard use authorization header you simply need to pass Authorization: Bearer  in every request to Dashboard. This can be achieved i.e. by configuring reverse proxy in front of Dashboard. Proxy will be responsible for authentication with identity provider and will pass generated token in request header to Dashboard. Note that Kubernetes API server needs to be configured properly to accept these tokens.</p>
</blockquote>
<p>For testing purpose you can use plugin which allows you to modify request headers.</p>
<p><strong>Side Note</strong></p>
<p><code>Authorization header will not work if Dashboard is accessed through API server proxy</code>. Both <code>kubectl proxy</code> and <code>API Server</code> way of accessing Dashboard described in <code>Accessing Dashboard</code> guide will not work. It is due to the fact that once request reaches API server all additional headers are dropped.</p>
<p>Example of <code>reverse proxy</code> is <code>Kublr</code>. Better description you can find in <a href="https://www.cncf.io/blog/2020/07/31/kubernetes-rbac-101-authentication/" rel="nofollow noreferrer">Leveraging Client Certificates and Bearer Tokens to Authenticate in Kubernetes</a> blog.</p>
