How to Deploy Kubernetes Dashboard and Manage Cluster Resources

Dashboard is an open-source web-based GUI for managing Kubernetes clusters. It allows you to manage cluster resources, deploy applications, monitor and troubleshoot cluster performance, and more using a web-based management interface. The Kubernetes Dashboard manages multiple resources and cluster workloads, including Cron Jobs, DaemonSets, Deployments, Pods, ReplicaSets, and StatefulSets, allowing you to deploy applications and monitor clusters in real time.

This article explains how to deploy the Kubernetes Dashboard, manage cluster resources using its web interface, and install an Ingress Controller to expose it securely.

Prerequisites

Before you start, you need to:

• Have access to a Kubernetes cluster.
• Install and Configure Kubectl to access your Kubernetes cluster.
• Install Helm on your workstation.

Install Kubernetes Dashboard

You can install the Kubernetes Dashboard using the official Helm repository. Follow the steps below to add a new Helm repository to your configuration and install the Kubernetes Dashboard to your cluster.

1. Add the Kubernetes Dashboard repository to your local Helm configuration.

   console Copy

   $ helm repo add kubernetes-dashboard https://kubernetes.github.io/dashboard/
   

   Explain Code

2. Update your local Helm configuration.

   console Copy

   $ helm repo update
   

   Explain Code

3. Install the Kubernetes Dashboard in your cluster using Helm.

   console Copy

   $ helm install kubernetes-dashboard kubernetes-dashboard/kubernetes-dashboard --create-namespace --namespace kubernetes-dashboard
   

   Explain Code

4. Check all installed components in the kubernetes-dashboard namespace.

   console Copy

   $ kubectl get all -n kubernetes-dashboard
   

   Explain Code

   From the output, verify that the Kubernetes Dashboard Pods, Services, and ReplicaSets are available and active.

Configure Access to the Kubernetes Dashboard

The Kubernetes Dashboard includes a minimal RBAC configuration by default and supports user login with bearer tokens. Every user needs a valid bearer token to access the Kubernetes Dashboard. Follow the steps below to create a new administrative service account and enable access to the Kubernetes Dashboard.

1. Create a new dashboard-admin-user.yml file using a text editor of your choice, like nano.

   console Copy

   $ nano dashboard-admin-user.yml
   

   Explain Code

2. Add the following YAML configurations to the dashboard-admin-user.yml file.

   yaml Copy

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: dashboard-admin-user
     namespace: kubernetes-dashboard
   ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
     name: dashboard-admin-user
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: cluster-admin
   subjects:
   - kind: ServiceAccount
     name: dashboard-admin-user
     namespace: kubernetes-dashboard
   

   Explain Code

   Save and close the dashboard-admin-user.yml file.

   The above configuration creates a new dashboard-admin-user service account and a cluster role binding that enables it to manage the cluster using the Kubernetes Dashboard.

   Warning

   The dashboard-admin-user ClusterRoleBinding references the cluster-admin role. This grants the highest privileges and full control over your entire cluster. Create a more restrictive Role or ClusterRole for production use.

3. Apply the configuration file.

   console Copy

   $ kubectl apply -f dashboard-admin-user.yml
   

   Explain Code

4. Create a new bearer token for the dashboard-admin-user service account to use when accessing the Kubernetes Dashboard.

   console Copy

   $ kubectl -n kubernetes-dashboard create token dashboard-admin-user
   

   Explain Code

   Copy the generated string from your output to later use as a login Bearer token.

Access the Kubernetes Dashboard

You can access the Kubernetes Dashboard after deploying it to your cluster using port forwarding or installing an Ingress Controller to attach a load balancer with a public endpoint to your cluster. This section covers accessing the Kubernetes Dashboard using port forwarding.

1. The kubernetes-dashboard-kong-proxy service, which was created when you installed Kubernetes Dashboard, provides an HTTPS endpoint to access the Kubernetes Dashboard. Forward the kubernetes-dashboard-kong-proxy service port 443 to port 8443 on your local workstation.

   console Copy

   $ kubectl port-forward service/kubernetes-dashboard-kong-proxy 8443:443 -n kubernetes-dashboard
   

   Explain Code

2. If using a remote cloud server to manage your Kubernetes cluster, follow the steps below.

   1. Allow the forwarded port through the firewall if it's active.

      console Copy

      $ sudo ufw allow 8443/tcp
      

      Explain Code

   2. Reload the firewall to apply the change.

      console Copy

      $ sudo ufw reload
      

      Explain Code

   3. Forward the kubernetes-dashboard port 443 to 8443 to access the Kubernetes Dashboard using your instance's public IP address.

      console Copy

      $ kubectl port-forward service/kubernetes-dashboard-kong-proxy 8443:443 -n kubernetes-dashboard --address='0.0.0.0'
      

      Explain Code

      Your output should be similar to the one below when successful.

      Forwarding from 0.0.0.0:8443 -> 8443

3. Visit your remote server's IP address or localhost (if managing Kubernetes locally) using https in a web browser like Chrome.

   https://127.0.0.1:8443

   Or

   https://SERVER-IP:8443

   Accept the insecure connection warning when prompted to access the Kubernetes Dashboard.

   

4. Paste the dashboard-admin-user token you generated earlier and click Sign in to access the Kubernetes Dashboard.

5. Verify the status of all workloads in the default namespace.

6. Click the namespace selector on the top navigation bar next to Kubernetes and select kubernetes-dashboard from the list.

   

7. Verify the status of all workloads in the kubernetes-dashboard namespace and monitor the active Deployments, Pods, and ReplicaSets.

8. Click Nodes within the Cluster group on the main navigation menu and verify the resource usage statistics for all nodes in your cluster.

   

Secure the Kubernetes Dashboard

Running the Kubernetes Dashboard using a public endpoint may expose your cluster to multiple threats. Installing an Ingress Controller enables you to secure the Kubernetes dashboard using a domain with trusted TLS connections using HTTPS to your cluster. Follow the steps below to install the Nginx Ingress Controller in your cluster and generate trusted SSL certificates using cert-manager to secure access to the Kubernetes Dashboard.

1. Press Ctrl + C to stop port forwarding in your terminal.

2. Install Nginx Ingress Controller.

   1. Add the Nginx Ingress Controller Helm repository.

      console Copy

      $ helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
      

      Explain Code

   2. Update your Helm repositories.

      console Copy

      $ helm repo update
      

      Explain Code

   3. Install the Nginx Ingress Controller in your cluster using Helm.

      console Copy

      $ helm install ingress-nginx ingress-nginx/ingress-nginx \
      --namespace ingress-nginx \
      --create-namespace
      

      Explain Code

   4. Wait a few minutes for the Nginx Ingress Controller to deploy and attach a load balancer to your Kubernetes cluster, then list all services in the ingress-nginx namespace.

      console Copy

      $ kubectl get services -n ingress-nginx
      

      Explain Code

      Verify the EXTERNAL-IP address assigned to your ingress-nginx LoadBalancer service and update your domain's DNS records to this IP value.

3. Install Cert-Manager.

   1. Add the Jetstack repository to your local Helm configuration.

      console Copy

      $ helm repo add jetstack https://charts.jetstack.io
      

      Explain Code

   2. Update your local Helm configuration.

      console Copy

      $ helm repo update
      

      Explain Code

   3. Install cert-manager and all required CRDs in your Kubernetes cluster.

      console Copy

      $ helm install cert-manager jetstack/cert-manager \
        --namespace cert-manager \
        --create-namespace \
        --set crds.enabled=true
      

      Explain Code

   4. List all installed resources in the cert-manager namespace and verify if they are up and running.

      console Copy

      $ kubectl get all -n cert-manager
      

      Explain Code

4. Create a ClusterIssuer resource to generate a TLS certificate for enabling a secure HTTPS connection to the Kubernetes Dashboard.

   1. Create a new issuer.yml manifest file to specify the Let's Encrypt ClusterIssuer configuration.

      console Copy

      $ nano issuer.yml
      

      Explain Code

   2. Add the following manifest to the file. Replace admin@example.com with your active email address.

      yaml Copy

      apiVersion: cert-manager.io/v1
      kind: ClusterIssuer
      metadata:
        name: tls-certificate-issuer
      spec:
        acme:
          server: https://acme-v02.api.letsencrypt.org/directory
          email: admin@example.com
          privateKeySecretRef:
            name: letsencrypt-private-key
          solvers:
            - http01:
                ingress:
                  ingressClassName: nginx
      

      Explain Code

      Save and close the file.

      The above configuration creates a new ClusterIssuer resource that uses the Let's Encrypt CA to complete domain challenges and generate trusted SSL certificates.

   3. Apply the ClusterIssuer manifest file.

      console Copy

      $ kubectl apply -f issuer.yml
      

      Explain Code

   4. List all ClusterIssuers and verify that tls-certificate-issuer is available.

      console Copy

      $ kubectl get clusterissuer
      

      Explain Code

      Output:

      NAME                     READY   AGE
      tls-certificate-issuer   True    74s

5. Patch the ingress-nginx-controller ConfigMap to allow the newer version of cert-manager to complete its domain verification. This is required because a strict setting in Nginx can block the automatic process cert-manager uses to prove you own the domain, which prevents it from issuing the TLS certificate.

   console Copy

   $ kubectl patch configmap ingress-nginx-controller -n ingress-nginx --patch '{"data":{"strict-validate-path-type":"false"}}'
   

   Explain Code

6. Create a new dashboard-ingress.yml file to specify the Kubernetes Dashboard Ingress configuration.

   console Copy

   $ nano dashboard-ingress.yml
   

   Explain Code

7. Add the following Ingress manifest to the file. Replace dashboard.example.com with your actual domain name.

   yaml Copy

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: kubernetes-dashboard-ingress
     namespace: kubernetes-dashboard
     annotations:
       cert-manager.io/cluster-issuer: tls-certificate-issuer
       nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
   spec:
     ingressClassName: nginx
     tls:
       - hosts:
           - dashboard.example.com
         secretName: kubernetes-dashboard-cert
     rules:
       - host: dashboard.example.com
         http:
           paths:
             - path: /
               pathType: Prefix
               backend:
                 service:
                   name: kubernetes-dashboard-kong-proxy
                   port:
                     number: 443
   

   Explain Code

   Save and close the file.

   The above configuration creates a new Ingress resource in the kubernetes-dashboard namespace that forwards all incoming requests from dashboard.example.com to the kubernetes-dashboard-kong-proxy service port 443.

8. Apply the dashboard-ingress.yml manifest to your cluster to create the Ingress resource.

   console Copy

   $ kubectl apply -f dashboard-ingress.yml
   

   Explain Code

9. Verify the TLS certificate status.

   console Copy

   $ kubectl get certificate -n kubernetes-dashboard
   

   Explain Code

   Output:

   NAME                        READY   SECRET                      AGE
   kubernetes-dashboard-cert   True    kubernetes-dashboard-cert   41s

   Note

   It may take some time for the certificate's READY state to turn True.

10. List all Ingress resources in the kubernetes-dashboard namespace and verify that dashboard-ingress is available.

    console Copy

    $ kubectl get ingress -n kubernetes-dashboard
    

    Explain Code

    Output:

    NAME                           CLASS   HOSTS                   ADDRESS         PORTS     AGE
    kubernetes-dashboard-ingress   nginx   dashboard.example.com   45.63.114.213   80, 443   16m

11. Access your dashboard.example.com domain in a new web browser window.

    https://dashboard.example.com

    

Deploy Applications using the Kubernetes Dashboard

You can deploy applications in your cluster directly using the Kubernetes Dashboard, allowing you to apply YAML configurations or fill in the application details directly using the web-based management interface. Follow the steps below to deploy a sample Nginx application in your cluster by specifying the resource details in a form using the Kubernetes Dashboard.

1. Create another subdomain A record pointing to your Ingress Controller's external IP address. For example, sample-app.example.com.

2. Open the Kubernetes Dashboard.

   https://dashboard.example.com

3. Enter your dashboard-admin-user token when prompted to log in to the Kubernetes Dashboard.

4. Click + in the top right corner to create a new resource configuration.

   

5. Navigate to the Create from form tab to specify the application information.

6. Enter the application name in the App name field. For example, sample-app.

7. Enter a public container URL in the Container Image field. For example, nginxdemos/hello to pull from DockerHub.

8. Click the Service drop-down and select Internal from the list.

   

   Enter the service's network port details, including:

   • Port: The internal port the service exposes to other resources in the cluster. For example, 80.
   • Target Port: The target container port within the pod to which incoming traffic is forwarded. For example, 80.
   • Protocol: The TCP or UDP network protocol to route traffic from the service to the pod.

9. Click the Namespace drop-down and select the target namespace to deploy the application, such as default.

10. Click Deploy to apply the application configuration to your cluster.

11. Monitor the application's deployment progress on the Workloads page, then navigate to Pods and verify that all pods are running.

    

12. Navigate to Services and verify that the sample-app service is available.

    

13. Click Create new resource to set up a new Ingress configuration for your application.

14. Add the following manifest to the Create from input field.

    yaml Copy

    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: sample-app-ingress
      annotations:
        cert-manager.io/cluster-issuer: tls-certificate-issuer
    spec:
      ingressClassName: nginx
      tls:
        - hosts:
            - sample-app.example.com
          secretName: sample-app-cert
      rules:
        - host: sample-app.example.com
          http:
            paths:
              - path: /
                pathType: Prefix
                backend:
                  service:
                    name: sample-app
                    port:
                      number: 80
    

    Explain Code

    The above Ingress configuration forwards incoming connections from your sample-app.example.com domain to the sample-app service on port 80. The tls-certificate-issuer automatically generates a new SSL certificate for the sample-app.example.com domain if it's pointing to the Ingress Controller's public IP address, enabling secure TLS connections to the application.

15. Click Upload to apply the Ingress configuration to your cluster.

    

16. Navigate to Ingresses on the main navigation menu.

17. Verify that the new Ingress resource is available and points to your domain.

    

18. Click the Ingress resource name to view its additional information or modify the configuration.

19. Open the sample-app.example.com domain in your web browser.

    https://sample-app.example.com

20. Verify that the sample Nginx application displays with the active pod's internal IP in your browser.

    

21. Click Auto Refresh to automatically reload the application to verify that traffic is actively load-balanced to all pods in your cluster.

    

Conclusion

In this article, you deployed the Kubernetes Dashboard in your cluster and exposed it securely using the Nginx Ingress controller. You can now use the Kubernetes Dashboard to deploy applications, manage your cluster, and create additional resources. For more information and configuration options, visit the Kubernetes documentation.