Kubernetes dashboard - Step-by-Step Execution

Process Flow - Kubernetes dashboard

Start Kubernetes Cluster

↓

Deploy Dashboard Manifest

↓

Create Service Account & Role

↓

Access Dashboard via Proxy or Token

↓

Dashboard UI Loads

↓

User Interacts with Cluster Resources

↓

Dashboard Shows Cluster State & Metrics

This flow shows how the Kubernetes dashboard is deployed, accessed, and used to view and manage cluster resources.

Execution Sample

Kubernetes

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml
kubectl proxy
# Access dashboard at http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/
# Use token from service account for login

This code deploys the Kubernetes dashboard, starts a proxy to access it locally, and shows how to open the dashboard in a browser.

Process Table

Step	Command/Action	Result/Output	System State Change
1	kubectl apply -f dashboard.yaml	deployment.apps/kubernetes-dashboard created service/kubernetes-dashboard created	Dashboard components deployed in cluster
2	kubectl create serviceaccount dashboard-admin-sa -n kubernetes-dashboard	serviceaccount/dashboard-admin-sa created	Service account created for dashboard access
3	kubectl create clusterrolebinding dashboard-admin-sa --clusterrole=cluster-admin --serviceaccount=kubernetes-dashboard:dashboard-admin-sa	clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin-sa created	Admin permissions granted to service account
4	kubectl proxy	Starting to serve on 127.0.0.1:8001	Local proxy running to access cluster API
5	Open browser at dashboard URL	Dashboard login page loads	User can enter token to authenticate
6	User enters token and logs in	Dashboard UI shows cluster resources	Dashboard connected and displaying cluster state
7	User views pods, deployments, services	Dashboard shows live status and metrics	User can manage cluster resources via UI
8	Exit	User closes dashboard or proxy	Dashboard access ends

💡 User closes proxy or dashboard, ending the session

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	Final
Dashboard Deployment	Not Deployed	Deployed	Deployed	Deployed	Deployed	Deployed	Deployed	Deployed
Service Account	None	None	Created	Created	Created	Created	Created	Created
Proxy Status	Not Running	Not Running	Not Running	Not Running	Running	Running	Running	Stopped
User Authenticated	No	No	No	No	No	No	Yes	No

Key Moments - 3 Insights

Why do we need to create a service account and cluster role binding?

The dashboard needs permissions to view and manage cluster resources. Creating a service account with cluster-admin role (see steps 2 and 3 in execution_table) grants these permissions securely.

Why do we use 'kubectl proxy' to access the dashboard?

The dashboard runs inside the cluster and is not exposed externally by default. 'kubectl proxy' creates a secure local tunnel to the cluster API server, allowing safe access to the dashboard UI (step 4).

What happens if the user does not provide a token at login?

Without a valid token, the dashboard will not authenticate the user, so the UI will not load cluster data (step 6). The user must provide a token from the service account to proceed.

Visual Quiz - 3 Questions

Look at the execution_table at step 4. What is the state of the proxy?

A Proxy is running and serving on localhost

B Proxy is not started yet

C Proxy has stopped

D Proxy is running but not serving

💡 Hint

Check the 'Result/Output' column at step 4 in execution_table

At which step does the dashboard UI become accessible to the user?

A Step 3

B Step 6

C Step 5

D Step 7

💡 Hint

Look for when the browser opens the dashboard URL in execution_table

If the service account was not created, what would happen at step 6?

A Dashboard UI would load normally

B User would be unable to authenticate and see cluster data

C Proxy would fail to start

D Dashboard deployment would fail

💡 Hint

Refer to key_moments about authentication and service account permissions

Concept Snapshot

Kubernetes Dashboard Quick Guide:
- Deploy with: kubectl apply -f recommended.yaml
- Create service account and clusterrolebinding for access
- Use 'kubectl proxy' to securely access dashboard locally
- Open browser at proxy URL to login
- Login with token from service account
- Dashboard shows cluster resources and metrics
- Manage cluster visually via dashboard UI

Full Transcript

The Kubernetes dashboard is a web UI to manage and monitor your cluster. First, you deploy the dashboard components using kubectl apply. Then, you create a service account with admin permissions so the dashboard can access cluster data. Next, you run 'kubectl proxy' to create a secure local connection to the cluster API. You open the dashboard URL in your browser, which shows a login page. You authenticate using a token from the service account. After login, the dashboard UI loads and displays cluster resources like pods and deployments. You can interact with these resources visually. When done, you close the proxy or dashboard to end the session.

Practice

1. What is the primary purpose of the Kubernetes dashboard?

easy

A. To automatically scale pods based on CPU usage

B. To replace the kubectl command-line tool entirely

C. To serve as a container runtime for Kubernetes

D. To provide a web-based user interface for managing Kubernetes clusters

Solution

1. Step 1: Understand the role of Kubernetes dashboard

   The dashboard is designed as a web UI to help users visually manage and monitor their Kubernetes clusters.

2. Step 2: Compare with other Kubernetes components

   It does not replace kubectl, nor does it handle scaling or container runtime tasks.

3. Final Answer:

   To provide a web-based user interface for managing Kubernetes clusters -> Option D

4. Quick Check:

   Kubernetes dashboard = Web UI for cluster management [OK]

Hint: Dashboard = visual cluster management tool [OK]

Common Mistakes:

• Thinking dashboard replaces kubectl
• Confusing dashboard with autoscaling
• Assuming dashboard is a container runtime

2. Which command correctly installs the Kubernetes dashboard?

easy

A. kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml

B. kubectl create dashboard

C. kubectl run dashboard --image=kubernetes/dashboard

D. kubectl install dashboard

Solution

1. Step 1: Identify the installation method for the dashboard

   The official way to install the Kubernetes dashboard is by applying the recommended YAML manifest from the official GitHub repository.

2. Step 2: Verify the command syntax

   kubectl apply -f [URL] is the correct syntax to apply a manifest file from a URL.

3. Final Answer:

   kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml -> Option A

4. Quick Check:

   Install dashboard = kubectl apply -f URL [OK]

Hint: Use kubectl apply with official dashboard YAML URL [OK]

Common Mistakes:

• Using kubectl create instead of apply
• Trying kubectl run which is for pods
• Using non-existent kubectl install command

3. After running kubectl proxy, what URL should you open in your browser to access the Kubernetes dashboard?

medium

A. http://localhost:8080/dashboard

B. http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/

C. https://dashboard.kubernetes.local

D. http://127.0.0.1:6443/dashboard

Solution

1. Step 1: Understand kubectl proxy behavior

   Running kubectl proxy creates a local proxy on port 8001 that forwards requests to the Kubernetes API server.

2. Step 2: Identify the dashboard proxy URL

   The dashboard is accessed via the API server proxy path: /api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/ on localhost port 8001.

3. Final Answer:

   http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/ -> Option B

4. Quick Check:

   Dashboard URL after proxy = localhost:8001/api/v1/... [OK]

Hint: Dashboard URL uses kubectl proxy on localhost:8001 [OK]

Common Mistakes:

• Using wrong port like 8080 or 6443
• Trying HTTPS without proxy
• Using a made-up domain name

4. You installed the Kubernetes dashboard but get a 403 Forbidden error when accessing it. What is the most likely cause?

medium

A. You did not create a login token or proper access permissions

B. The dashboard service is not running

C. kubectl proxy is not installed

D. Your browser does not support HTTPS

Solution

1. Step 1: Understand 403 Forbidden meaning

   A 403 error means access is denied due to lack of permissions or authentication.

2. Step 2: Check dashboard access requirements

   The dashboard requires a valid login token with proper RBAC permissions to allow access.

3. Final Answer:

   You did not create a login token or proper access permissions -> Option A

4. Quick Check:

   403 Forbidden = missing token or permissions [OK]

Hint: 403 means missing token or permissions [OK]

Common Mistakes:

• Assuming service is not running without checking
• Thinking kubectl proxy is missing (it's a client tool)
• Blaming browser HTTPS support

5. You want to securely access the Kubernetes dashboard remotely without exposing it publicly. Which approach is best?

hard

A. Expose the dashboard service with a LoadBalancer type service

B. Disable authentication on the dashboard for easy access

C. Use kubectl proxy on your local machine and SSH tunnel to the cluster

D. Access the dashboard directly via the cluster IP from anywhere

Solution

1. Step 1: Consider security for remote access

   Exposing the dashboard publicly or disabling authentication is insecure and not recommended.

2. Step 2: Use kubectl proxy with SSH tunneling

   Running kubectl proxy locally and creating an SSH tunnel to the cluster securely forwards traffic without exposing the dashboard publicly.

3. Final Answer:

   Use kubectl proxy on your local machine and SSH tunnel to the cluster -> Option C

4. Quick Check:

   Secure remote access = kubectl proxy + SSH tunnel [OK]

Hint: Secure access = kubectl proxy plus SSH tunnel [OK]

Common Mistakes:

• Exposing dashboard publicly with LoadBalancer
• Disabling authentication for convenience
• Trying to access cluster IP directly without security