<p>I just upgraded kubeadm and kubelet to v1.8.0. And install the dashboard following the official <a href="https://github.com/kubernetes/dashboard" rel="noreferrer">document</a>.</p>

<pre><code>$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/recommended/kubernetes-dashboard.yaml
</code></pre>

<p>After that, I started the dashboard by running</p>

<pre><code>$ kubectl proxy --address="192.168.0.101" -p 8001 --accept-hosts='^*$'
</code></pre>

<p>Then fortunately, I was able to access the dashboard thru <a href="http://192.168.0.101:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/" rel="noreferrer">http://192.168.0.101:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/</a></p>

<p>I was redirected to a login page like this which I had never met before. 
<a href="https://i.stack.imgur.com/5dy2F.png" rel="noreferrer"><img src="https://i.stack.imgur.com/5dy2F.png" alt="enter image description here"></a> It looks like that there are two ways of authentication. </p>

<p>I tried to upload the <code>/etc/kubernetes/admin.conf</code> as the kubeconfig but got failed. Then I tried to use the token I got from <code>kubeadm token list</code> to sign in but failed again. </p>

<p>The question is how I can sign in the dashboard. It looks like they added a lot of security mechanism than before. Thanks. </p>

<blockquote>
  <p>As of release 1.7 Dashboard supports user authentication based on:</p>
  
  <ul>
  <li><a href="https://github.com/kubernetes/dashboard/blob/v2.0.0/docs/user/access-control/README.md#authorization-header" rel="noreferrer"><code>Authorization: Bearer &lt;token&gt;</code></a> header passed in every request to Dashboard. Supported from release 1.6. Has the highest priority. If present, login view will not be shown.</li>
  <li><a href="https://github.com/kubernetes/dashboard/blob/v2.0.0/docs/user/access-control/README.md#bearer-token" rel="noreferrer">Bearer Token</a> that can be used on Dashboard <a href="https://github.com/kubernetes/dashboard/blob/v2.0.0/docs/user/access-control/README.md#login-view" rel="noreferrer">login view</a>.</li>
  <li><a href="https://github.com/kubernetes/dashboard/blob/v2.0.0/docs/user/access-control/README.md#basic" rel="noreferrer">Username/password</a> that can be used on Dashboard <a href="https://github.com/kubernetes/dashboard/blob/v2.0.0/docs/user/access-control/README.md#login-view" rel="noreferrer">login view</a>.</li>
  <li><a href="https://github.com/kubernetes/dashboard/blob/v2.0.0/docs/user/access-control/README.md#kubeconfig" rel="noreferrer">Kubeconfig</a> file that can be used on Dashboard <a href="https://github.com/kubernetes/dashboard/blob/v2.0.0/docs/user/access-control/README.md#login-view" rel="noreferrer">login view</a>.</li>
  </ul>
</blockquote>

<p>— <a href="https://github.com/kubernetes/dashboard" rel="noreferrer">Dashboard on Github</a></p>

<h2>Token</h2>

<p>Here <code>Token</code> can be <code>Static Token</code>, <code>Service Account Token</code>, <code>OpenID Connect Token</code> from <a href="https://kubernetes.io/docs/admin/authentication/" rel="noreferrer">Kubernetes Authenticating</a>, but not the kubeadm <code>Bootstrap Token</code>.</p>

<p>With kubectl, we can get an service account (eg. deployment controller) created in kubernetes by default.</p>

<pre><code>$ kubectl -n kube-system get secret
# All secrets with type 'kubernetes.io/service-account-token' will allow to log in.
# Note that they have different privileges.
NAME                                     TYPE                                  DATA      AGE
deployment-controller-token-frsqj        kubernetes.io/service-account-token   3         22h

$ kubectl -n kube-system describe secret deployment-controller-token-frsqj
Name:         deployment-controller-token-frsqj
Namespace:    kube-system
Labels:       &lt;none&gt;
Annotations:  kubernetes.io/service-account.name=deployment-controller
              kubernetes.io/service-account.uid=64735958-ae9f-11e7-90d5-02420ac00002

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJkZXBsb3ltZW50LWNvbnRyb2xsZXItdG9rZW4tZnJzcWoiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVwbG95bWVudC1jb250cm9sbGVyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiNjQ3MzU5NTgtYWU5Zi0xMWU3LTkwZDUtMDI0MjBhYzAwMDAyIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmRlcGxveW1lbnQtY29udHJvbGxlciJ9.OqFc4CE1Kh6T3BTCR4XxDZR8gaF1MvH4M3ZHZeCGfO-sw-D0gp826vGPHr_0M66SkGaOmlsVHmP7zmTi-SJ3NCdVO5viHaVUwPJ62hx88_JPmSfD0KJJh6G5QokKfiO0WlGN7L1GgiZj18zgXVYaJShlBSz5qGRuGf0s1jy9KOBt9slAN5xQ9_b88amym2GIXoFyBsqymt5H-iMQaGP35tbRpewKKtly9LzIdrO23bDiZ1voc5QZeAZIWrizzjPY5HPM1qOqacaY9DcGc7akh98eBJG_4vZqH2gKy76fMf0yInFTeNKr45_6fWt8gRM77DQmPwb3hbrjWXe1VvXX_g
</code></pre>

<h2>Kubeconfig</h2>

<p>The dashboard needs the user in the kubeconfig file to have either <code>username &amp; password</code> or <code>token</code>, but <code>admin.conf</code> only has <code>client-certificate</code>.  You can edit the config file to add the token that was extracted using the method above.</p>

<pre>
$ kubectl config set-credentials cluster-admin --token=<i>bearer_token</i></pre>

<h1>Alternative (Not recommended for Production)</h1>

<p>Here are two ways to bypass the authentication, but use for caution. </p>

<h2>Deploy dashboard with HTTP</h2>

<pre><code>$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/alternative/kubernetes-dashboard.yaml
</code></pre>

<p>Dashboard can be loaded at <a href="http://localhost:8001/ui" rel="noreferrer">http://localhost:8001/ui</a> with <code>kubectl proxy</code>.</p>

<h2>Granting admin privileges to Dashboard's Service Account</h2>

<pre><code>$ cat &lt;&lt;EOF | kubectl create -f -
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
  labels:
    k8s-app: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system
EOF
</code></pre>

<p>Afterwards you can use <kbd>Skip</kbd> option on login page to access Dashboard.</p>

<p>If you are using dashboard version v1.10.1 or later, you must also add <code>--enable-skip-login</code> to the deployment's command line arguments. You can do so by adding it to the <code>args</code> in <code>kubectl edit deployment/kubernetes-dashboard --namespace=kube-system</code>.</p>

<p>Example:</p>

<pre><code>      containers:
      - args:
        - --auto-generate-certificates
        - --enable-skip-login            # &lt;-- add this line
        image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
</code></pre>
