How to Deploy Kubernetes Dashboard and Manage Cluster Resources

Dashboard is an open-source web-based GUI for managing Kubernetes clusters. It allows you to manage cluster resources, deploy applications, monitor and troubleshoot cluster performance, all through a web-based management interface. The Kubernetes Dashboard manages multiple resources and cluster workloads, including CronJobs, DaemonSets, Deployments, Pods, ReplicaSets, and StatefulSets, allowing you to deploy applications and monitor clusters in real time.

This article explains how to deploy the Kubernetes Dashboard, manage cluster resources using its web interface, and install an Ingress Controller to expose it securely.

Prerequisites

Before you start, you need to:

• Have access to a Kubernetes cluster.
• Install and configure Kubectl to access your Kubernetes cluster.
• Install Helm on your workstation.

Install Kubernetes Dashboard

You can install the Kubernetes Dashboard using the official Helm repository. Follow the steps below to add a new Helm repository to your configuration and install the Kubernetes Dashboard to your cluster.

1. Add the Kubernetes Dashboard repository to your local Helm configuration.

   CONSOLE

   Copy

   $ helm repo add kubernetes-dashboard https://kubernetes.github.io/dashboard/

   Explain Code

   Powered by Vultr AgentBeta

2. Update your local Helm configuration.

   CONSOLE

   Copy

   $ helm repo update

   Explain Code

   Powered by Vultr AgentBeta

3. Install the Kubernetes Dashboard in your cluster using Helm.

   CONSOLE

   Copy

   $ helm install kubernetes-dashboard kubernetes-dashboard/kubernetes-dashboard --create-namespace --namespace kubernetes-dashboard

   Explain Code

   Powered by Vultr AgentBeta

4. Check all installed components in the kubernetes-dashboard namespace.

   CONSOLE

   Copy

   $ kubectl get all -n kubernetes-dashboard

   Explain Code

   Powered by Vultr AgentBeta

   From the output, verify that the Kubernetes Dashboard Pods, Services, and ReplicaSets are available and active.

Configure Access to the Kubernetes Dashboard

The Kubernetes Dashboard, by default, includes a minimal RBAC configuration and supports user login with bearer tokens. Every user needs a valid bearer token to access the Kubernetes Dashboard. Follow the steps below to create a new administrative service account and enable access to the Kubernetes Dashboard.

1. Create a new dashboard-admin-user.yml file using a text editor of your choice, like nano.

   CONSOLE

   Copy

   $ nano dashboard-admin-user.yml

   Explain Code

   Powered by Vultr AgentBeta

2. Add the following YAML configurations to the dashboard-admin-user.yml file.

   YAML

   Copy

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: dashboard-admin-user
     namespace: kubernetes-dashboard
   ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
     name: dashboard-admin-user
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: cluster-admin
   subjects:
   - kind: ServiceAccount
     name: dashboard-admin-user
     namespace: kubernetes-dashboard

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the dashboard-admin-user.yml file.

   The above configuration creates a new dashboard-admin-user service account and a cluster role binding that enables it to manage the cluster using the Kubernetes Dashboard.

   Warning

   The dashboard-admin-user ClusterRoleBinding references the cluster-admin role. This grants the highest privileges and full control over your entire cluster. Create a more restrictive Role or ClusterRole for production use.

3. Apply the configuration file.

   CONSOLE

   Copy

   $ kubectl apply -f dashboard-admin-user.yml

   Explain Code

   Powered by Vultr AgentBeta

4. Create a new bearer token for the dashboard-admin-user service account to use when accessing the Kubernetes Dashboard.

   CONSOLE

   Copy

   $ kubectl -n kubernetes-dashboard create token dashboard-admin-user

   Explain Code

   Powered by Vultr AgentBeta

   Copy the generated string from your output to later use as a login Bearer token.

Access the Kubernetes Dashboard

You can access the Kubernetes Dashboard after deploying it to your cluster using port forwarding or installing an Ingress Controller to attach a load balancer with a public endpoint to your cluster. This section covers accessing the Kubernetes Dashboard using port forwarding.

1. The kubernetes-dashboard-kong-proxy service, which was created when you installed Kubernetes Dashboard, provides an HTTPS endpoint to access the Kubernetes Dashboard. Forward the kubernetes-dashboard-kong-proxy service port 443 to port 8443 on your local workstation.

   CONSOLE

   Copy

   $ kubectl port-forward service/kubernetes-dashboard-kong-proxy 8443:443 -n kubernetes-dashboard

   Explain Code

   Powered by Vultr AgentBeta

2. If using a remote cloud server to manage your Kubernetes cluster, follow the steps below.

   1. Allow the forwarded port through the firewall if it's active.

      CONSOLE

      Copy

      $ sudo ufw allow 8443/tcp

      Explain Code

      Powered by Vultr AgentBeta

   2. Reload the firewall to apply the change.

      CONSOLE

      Copy

      $ sudo ufw reload

      Explain Code

      Powered by Vultr AgentBeta

   3. Forward the kubernetes-dashboard port 443 to 8443 to access the Kubernetes Dashboard using your instance's public IP address.

      CONSOLE

      Copy

      $ kubectl port-forward service/kubernetes-dashboard-kong-proxy 8443:443 -n kubernetes-dashboard --address='0.0.0.0'

      Explain Code

      Powered by Vultr AgentBeta

      Your output should be similar to the one below when successful.

      Forwarding from 0.0.0.0:8443 -> 8443

3. Visit your remote server's IP address or localhost (if managing Kubernetes locally) using https in a web browser like Chrome.

   https://127.0.0.1:8443

   Or

   https://SERVER-IP:8443

   Accept the insecure connection warning when prompted to access the Kubernetes Dashboard.

   

4. Paste the dashboard-admin-user token you generated earlier and click Sign in to access the Kubernetes Dashboard.

5. Verify the status of all workloads in the default namespace.

6. Click the namespace selector on the top navigation bar next to Kubernetes and select kubernetes-dashboard from the list.

   

7. Verify the status of all workloads in the kubernetes-dashboard namespace and monitor the active Deployments, Pods, and ReplicaSets.

8. Click Nodes within the Cluster group on the main navigation menu and verify the resource usage statistics for all nodes in your cluster.

   

Secure the Kubernetes Dashboard

Running the Kubernetes Dashboard using a public endpoint may expose your cluster to multiple threats. Installing an Ingress Controller lets you secure the Kubernetes Dashboard with a trusted TLS certificate and access it over HTTPS. Follow the steps below to install the Nginx Ingress Controller in your cluster and generate trusted TLS certificates using cert-manager to secure access to the Kubernetes Dashboard.

1. Press Ctrl + C to stop port forwarding in your terminal.

2. Install Nginx Ingress Controller.

   1. Add the Nginx Ingress Controller Helm repository.

      CONSOLE

      Copy

      $ helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx

      Explain Code

      Powered by Vultr AgentBeta

   2. Update your Helm repositories.

      CONSOLE

      Copy

      $ helm repo update

      Explain Code

      Powered by Vultr AgentBeta

   3. Install the Nginx Ingress Controller in your cluster using Helm.

      CONSOLE

      Copy

      $ helm install ingress-nginx ingress-nginx/ingress-nginx \
      --namespace ingress-nginx \
      --create-namespace

      Explain Code

      Powered by Vultr AgentBeta

   4. Wait a few minutes for the Nginx Ingress Controller to deploy and attach a load balancer to your cluster. Then, list all services in the ingress-nginx namespace.

      CONSOLE

      Copy

      $ kubectl get services -n ingress-nginx

      Explain Code

      Powered by Vultr AgentBeta

      Verify the EXTERNAL-IP address assigned to your ingress-nginx LoadBalancer service and update your domain's DNS records to this IP value.

3. Install Cert-Manager.

   1. Add the Jetstack repository to your local Helm configuration.

      CONSOLE

      Copy

      $ helm repo add jetstack https://charts.jetstack.io

      Explain Code

      Powered by Vultr AgentBeta

   2. Update your local Helm configuration.

      CONSOLE

      Copy

      $ helm repo update

      Explain Code

      Powered by Vultr AgentBeta

   3. Install cert-manager and all required CRDs in your Kubernetes cluster.

      CONSOLE

      Copy

      $ helm install cert-manager jetstack/cert-manager \
        --namespace cert-manager \
        --create-namespace \
        --set crds.enabled=true

      Explain Code

      Powered by Vultr AgentBeta

   4. List all installed resources in the cert-manager namespace and verify if they are up and running.

      CONSOLE

      Copy

      $ kubectl get all -n cert-manager

      Explain Code

      Powered by Vultr AgentBeta

4. Create a ClusterIssuer resource to generate a TLS certificate for enabling a secure HTTPS connection to the Kubernetes Dashboard.

   1. Create a new issuer.yml manifest file to specify the Let's Encrypt ClusterIssuer configuration.

      CONSOLE

      Copy

      $ nano issuer.yml

      Explain Code

      Powered by Vultr AgentBeta

   2. Add the following manifest to the file. Replace admin@example.com with your active email address.

      YAML

      Copy

      apiVersion: cert-manager.io/v1
      kind: ClusterIssuer
      metadata:
        name: tls-certificate-issuer
      spec:
        acme:
          server: https://acme-v02.api.letsencrypt.org/directory
          email: admin@example.com
          privateKeySecretRef:
            name: letsencrypt-private-key
          solvers:
            - http01:
                ingress:
                  ingressClassName: nginx

      Explain Code

      Powered by Vultr AgentBeta

      Save and close the file.

      The above configuration creates a new ClusterIssuer resource that uses the Let's Encrypt CA to complete domain challenges and generate trusted TLS certificates.

   3. Apply the ClusterIssuer manifest file.

      CONSOLE

      Copy

      $ kubectl apply -f issuer.yml

      Explain Code

      Powered by Vultr AgentBeta

   4. List all ClusterIssuers and verify that tls-certificate-issuer is available.

      CONSOLE

      Copy

      $ kubectl get clusterissuer

      Explain Code

      Powered by Vultr AgentBeta

      Output:

      NAME                     READY   AGE
      tls-certificate-issuer   True    74s

5. Patch the ingress-nginx-controller ConfigMap to allow the newer version of cert-manager to complete its domain verification. This is required because a strict setting in Nginx can block the automatic process cert-manager uses to prove you own the domain, which prevents it from issuing the TLS certificate.

   CONSOLE

   Copy

   $ kubectl patch configmap ingress-nginx-controller -n ingress-nginx --patch '{"data":{"strict-validate-path-type":"false"}}'

   Explain Code

   Powered by Vultr AgentBeta

6. Create a new dashboard-ingress.yml file to specify the Kubernetes Dashboard Ingress configuration.

   CONSOLE

   Copy

   $ nano dashboard-ingress.yml

   Explain Code

   Powered by Vultr AgentBeta

7. Add the following Ingress manifest to the file. Replace dashboard.example.com with your actual domain name.

   YAML

   Copy

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: kubernetes-dashboard-ingress
     namespace: kubernetes-dashboard
     annotations:
       cert-manager.io/cluster-issuer: tls-certificate-issuer
       nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
   spec:
     ingressClassName: nginx
     tls:
       - hosts:
           - dashboard.example.com
         secretName: kubernetes-dashboard-cert
     rules:
       - host: dashboard.example.com
         http:
           paths:
             - path: /
               pathType: Prefix
               backend:
                 service:
                   name: kubernetes-dashboard-kong-proxy
                   port:
                     number: 443

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

   The above configuration creates a new Ingress resource in the kubernetes-dashboard namespace that forwards all incoming requests from dashboard.example.com to the kubernetes-dashboard-kong-proxy service port 443.

8. Apply the dashboard-ingress.yml manifest to your cluster to create the Ingress resource.

   CONSOLE

   Copy

   $ kubectl apply -f dashboard-ingress.yml

   Explain Code

   Powered by Vultr AgentBeta

9. Verify the TLS certificate status.

   CONSOLE

   Copy

   $ kubectl get certificate -n kubernetes-dashboard

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   NAME                        READY   SECRET                      AGE
   kubernetes-dashboard-cert   True    kubernetes-dashboard-cert   41s

   Note

   It may take some time for the certificate's READY state to turn True.

10. List all Ingress resources in the kubernetes-dashboard namespace and verify that dashboard-ingress is available.

    CONSOLE

    Copy

    $ kubectl get ingress -n kubernetes-dashboard

    Explain Code

    Powered by Vultr AgentBeta

    Output:

    NAME                           CLASS   HOSTS                   ADDRESS         PORTS     AGE
    kubernetes-dashboard-ingress   nginx   dashboard.example.com   45.63.114.213   80, 443   16m

11. Access your dashboard.example.com domain in a new web browser window.

    https://dashboard.example.com

    

Deploy Applications using the Kubernetes Dashboard

You can deploy applications through the Kubernetes Dashboard by applying YAML configurations or filling in application details in the web-based interface. Follow the steps below to deploy a sample Nginx application in your cluster by specifying the resource details in a form using the Kubernetes Dashboard.

1. Create another subdomain A record pointing to your Ingress Controller's external IP address. For example, sample-app.example.com.

2. Open the Kubernetes Dashboard.

   https://dashboard.example.com

3. Enter your dashboard-admin-user token when prompted to log in to the Kubernetes Dashboard.

4. Click + in the top right corner to create a new resource configuration.

   

5. Navigate to the Create from form tab to specify the application information.

6. Enter the application name in the App name field. For example, sample-app.

7. Enter a public container URL in the Container Image field. For example, nginxdemos/hello to pull from DockerHub.

8. Click the Service drop-down and select Internal from the list.

   

   Enter the service's network port details, including:

   • Port: The internal port the service exposes to other resources in the cluster. For example, 80.
   • Target Port: The target container port within the pod to which incoming traffic is forwarded. For example, 80.
   • Protocol: The TCP or UDP network protocol to route traffic from the service to the pod.

9. Click the Namespace drop-down and select the target namespace to deploy the application, such as default.

10. Click Deploy to apply the application configuration to your cluster.

11. Monitor the application's deployment progress on the Workloads page, then navigate to Pods and verify that all pods are running.

    

12. Navigate to Services and verify that the sample-app service is available.

    

13. Click Create new resource to set up a new Ingress configuration for your application.

14. Add the following manifest to the Create from input field.

    YAML

    Copy

    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: sample-app-ingress
      annotations:
        cert-manager.io/cluster-issuer: tls-certificate-issuer
    spec:
      ingressClassName: nginx
      tls:
        - hosts:
            - sample-app.example.com
          secretName: sample-app-cert
      rules:
        - host: sample-app.example.com
          http:
            paths:
              - path: /
                pathType: Prefix
                backend:
                  service:
                    name: sample-app
                    port:
                      number: 80

    Explain Code

    Powered by Vultr AgentBeta

    This Ingress configuration forwards incoming traffic from sample-app.example.com to the sample-app service on port 80. The tls-certificate-issuer automatically generates a new TLS certificate for the sample-app.example.com domain if it's pointing to the Ingress Controller's public IP address, enabling secure TLS connections to the application.

15. Click Upload to apply the Ingress configuration to your cluster.

    

16. Navigate to Ingresses on the main navigation menu.

17. Verify that the new Ingress resource is available and points to your domain.

    

18. Click the Ingress resource name to view its additional information or modify the configuration.

19. Open the sample-app.example.com domain in your web browser.

    https://sample-app.example.com

20. Verify that the sample Nginx application displays with the active pod's internal IP in your browser.

    

21. Click Auto Refresh to automatically reload the application to verify that traffic is actively load-balanced to all pods in your cluster.

    

Conclusion

In this article, you deployed the Kubernetes Dashboard in your cluster and exposed it securely using the Nginx Ingress Controller. You can now use the Kubernetes Dashboard to deploy applications, manage your cluster, and create additional resources. For more information and configuration options, visit the Kubernetes documentation.