<p>I´d like to login on my newly installed kubernetes dashboard (k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.0) via token and it doesn´t work.</p>

<p>I have the exact same problem as on <a href="https://stackoverflow.com/questions/50553233/how-to-log-in-to-kubernetes-dashboard-ui-with-service-accounts-token/50554037#50554037">How to log in to Kubernetes Dashboard UI with Service Account&#39;s token</a>
but I verified my token and it fits. I also DON´T get the "Authentication failed..." error.</p>

<p>When I enter the token just nothing happens, but I see new entries in the logfile:</p>

<pre><code>{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Incoming HTTP/2.0 GET /api/v1/csrftoken/login request from 192.168.178.10:60092: { contents hidden }\n","stream":"stdout","time":"2018-12-07T14:59:49.655298186Z"}
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Outcoming response to 192.168.178.10:60092 with 200 status code\n","stream":"stdout","time":"2018-12-07T14:59:49.655840444Z"}
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Incoming HTTP/2.0 POST /api/v1/login request from 192.168.178.10:60092: { contents hidden }\n","stream":"stdout","time":"2018-12-07T14:59:49.665272088Z"}
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Outcoming response to 192.168.178.10:60092 with 200 status code\n","stream":"stdout","time":"2018-12-07T14:59:49.670318659Z"}
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Incoming HTTP/2.0 GET /api/v1/login/status request from 192.168.178.10:60092: {}\n","stream":"stdout","time":"2018-12-07T14:59:49.688294191Z"}
{"log":"2018/12/07 14:59:49 [2018-12-07T14:59:49Z] Outcoming response to 192.168.178.10:60092 with 200 status code\n","stream":"stdout","time":"2018-12-07T14:59:49.691135283Z"}
{"log":"2018/12/07 14:59:52 Metric client health check failed: the server could not find the requested resource (get services heapster). Retrying in 30 seconds.\n","stream":"stdout","time":"2018-12-07T14:59:52.237740364Z"}
</code></pre>

<p>What I´ve done:</p>

<pre><code>kubectl create serviceaccount myservice
kubectl get serviceaccount myservice -o yaml
</code></pre>

<p>Token:</p>

<pre><code>TOKEN=$(echo "ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNklpSjkuZXlKcGMzTWlPaUpyZFdKbGNtNWxkR1Z6TDNObGNuWnBZMlZoWTJOdmRXNTBJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5dVlXMWxjM0JoWTJVaU9pSmtaV1poZFd4MElpd2lhM1ZpWlhKdVpYUmxjeTVwYnk5elpYSjJhV05sWVdOamIzVnVkQzl6WldOeVpYUXVibUZ0WlNJNkltMTVjMlZ5ZG1salpTMTBiMnRsYmkxa09ISnlaQ0lzSW10MVltVnlibVYwWlhNdWFXOHZjMlZ5ZG1salpXRmpZMjkxYm5RdmMyVnlkbWxqWlMxaFkyTnZkVzUwTG01aGJXVWlPaUp0ZVhObGNuWnBZMlVpTENKcmRXSmxjbTVsZEdWekxtbHZMM05sY25acFkyVmhZMk52ZFc1MEwzTmxjblpwWTJVdFlXTmpiM1Z1ZEM1MWFXUWlPaUpoWWpFeVlUVmpOUzFtWVRKakxURXhaVGd0WVRZNE55MHdNRFV3TlRZNE9EZzRNak1pTENKemRXSWlPaUp6ZVhOMFpXMDZjMlZ5ZG1salpXRmpZMjkxYm5RNlpHVm1ZWFZzZERwdGVYTmxjblpwWTJVaWZRLm0yR2F4VmNsOTYzVkVjbUltb3dzY25aeWdrd2hQTTBlZmNjUnVoaGNmdlNWXzU5Y29wNkdMc2t0bTRtY1FqcjBnaWhzMTZXZjFrd1VkVjBlTFJNVE1zaWZudlQxR2J6Smd3ZURydTVMbHVteW5tY3Y3Sm1GVDFGLXpJSjI0SFRERVhlVTNtMV9OVjJHcUZHdTNmVTlxOVFscG44ZVRxR2FuNDZLdEM2OTZGUVBqbjFhVnRER28wMlVrU2NwVGRHckNkenFMUjFBT0ZMTXVyUWFjWldIbHlhTmZ4Sy02bU16aDBZdG1seHdfcEFSeVlySXJMVlR2dXlLeDRmQzRvWUx2elVia1pkWmp1eUlJWnFmYXVUMTFKQUFad243MHZyZW1xbVVHTXBsdXNaYVdiU2h3SlJkRWZmMzdjTEd3R3lwdU1SeXI2a3NsVlJiLW50eXdWbHYxQQ==" | base64 -d)

echo $TOKEN
eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6Im15c2VydmljZS10b2tlbi1kOHJyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJteXNlcnZpY2UiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJhYjEyYTVjNS1mYTJjLTExZTgtYTY4Ny0wMDUwNTY4ODg4MjMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpteXNlcnZpY2UifQ.m2GaxVcl963VEcmImowscnZygkwhPM0efccRuhhcfvSV_59cop6GLsktm4mcQjr0gihs16Wf1kwUdV0eLRMTMsifnvT1GbzJgweDru5Llumynmcv7JmFT1F-zIJ24HTDEXeU3m1_NV2GqFGu3fU9q9Qlpn8eTqGan46KtC696FQPjn1aVtDGo02UkScpTdGrCdzqLR1AOFLMurQacZWHlyaNfxK-6mMzh0Ytmlxw_pARyYrIrLVTvuyKx4fC4oYLvzUbkZdZjuyIIZqfauT11JAAZwn70vremqmUGMplusZaWbShwJRdEff37cLGwGypuMRyr6kslVRb-ntywVlv1A
</code></pre>

<p>I start </p>

<pre><code>kubectl proxy --port=9999 --address='192.168.178.10' --accept-hosts="^*$"
</code></pre>

<p>Does it work just on localhost (I don´t want to install a browser nor desktop)?</p>

<p>I´d also like to know, to get the dashboard permanently run, as after "ctrl + c" the "kubectl proxy" command.</p>

<p>I found the workarroud</p>

<pre><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
  labels:
    k8s-app: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system
EOF
</code></pre>

<p>Running this command and "skip" on the dashboard and I´m logged in, but how to get rid of this user as I can´t find it anymore via</p>

<pre><code>kubectl get serviceaccounts --all-namespaces
</code></pre>

<p>nor</p>

<pre><code>kubectl get serviceaccounts -n kube-system
</code></pre>

<p>?</p>

<p>How to get it run via https?</p>

<p>Thanks in advance
Tom</p>

<p>The answer to all my questions I found on </p>

<p><a href="http://www.joseluisgomez.com/containers/kubernetes-dashboard/" rel="nofollow noreferrer">http://www.joseluisgomez.com/containers/kubernetes-dashboard/</a></p>

<p>Access via <code>kubectl proxy</code> is not recommended for productive use (but unfortunately the only explained way on the kubernetes documentation).</p>

<p>It´s possible to access out of the box via https, but there are some additional steps required.</p>

<ol>
<li>Create a certificate:</li>
</ol>

<p><code>grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d &gt;&gt; kubecfg.crt</code></p>

<p><code>grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d &gt;&gt; kubecfg.key</code></p>

<p><code>openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name "kubernetes-client"</code></p>

<p>You´ll get a kubecfg.p12 which you have to download from kubernetes master and install on your client (double-click, next, next, next - Chrome Browser is recommended).</p>

<ol start="2">
<li>Install a service account with ClusterRoleBinding role:</li>
</ol>

<p><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system
EOF</code></p>

<p><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system
EOF</code></p>

<ol start="3">
<li>Get the bearer token for the account "kube-admin":</li>
</ol>

<p><code>kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')</code></p>

<ol start="4">
<li>Access <code>https://&lt;master-ip&gt;:&lt;apiserver-port&gt;/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy</code>, choose "Token" and put in the bearer token you´ll get from previous step and you´re done.</li>
</ol>

<p>Note: Information concering your cluster you´ll get via <code>kubectl cluster-info</code>.</p>
