From cde7d4b84bb4d00aa770bd7bf2ea7858c125e825 Mon Sep 17 00:00:00 2001 From: Suriya Date: Mon, 20 Jul 2026 12:37:59 +0530 Subject: [PATCH] Restore dashboard --enable-skip-login Skip-login was stripped in an earlier "harden security" pass, which is why the dashboard started demanding a token. Re-added it; it now runs as the dashboard's own view-only ServiceAccount (get/list/watch), so opening it needs no token but write access still requires the admin-user token as before. Co-Authored-By: Claude Sonnet 5 --- docs/DASHBOARD_SETUP.md | 8 +++++--- manifests/alaska/k8s-dashboard.yaml | 7 +++++++ 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/docs/DASHBOARD_SETUP.md b/docs/DASHBOARD_SETUP.md index 1a26bd6..009c8b4 100644 --- a/docs/DASHBOARD_SETUP.md +++ b/docs/DASHBOARD_SETUP.md @@ -49,14 +49,16 @@ kubectl get svc -n kubernetes-dashboard ### Login to Dashboard -The dashboard is configured with `--enable-skip-login`, so you can skip the login screen. However, if you need to authenticate: +The dashboard is configured with `--enable-skip-login`, so it opens straight to the UI - no token needed to look around. -1. Get the token: +Skip-login runs as the dashboard's own `kubernetes-dashboard` ServiceAccount, which is **view-only** (get/list/watch). If you need to edit, delete, or exec into something: + +1. Get an admin token: ```bash kubectl -n kubernetes-dashboard create token admin-user ``` -2. Copy the token and paste it in the dashboard login screen. +2. Click "Sign In" on the dashboard and paste the token. ### What You Can See diff --git a/manifests/alaska/k8s-dashboard.yaml b/manifests/alaska/k8s-dashboard.yaml index 7b6bca0..c8d7203 100644 --- a/manifests/alaska/k8s-dashboard.yaml +++ b/manifests/alaska/k8s-dashboard.yaml @@ -62,6 +62,13 @@ spec: args: - --auto-generate-certificates - --namespace=kubernetes-dashboard + - --enable-skip-login + # Skip-login uses the "kubernetes-dashboard" ServiceAccount below, + # which only has get/list/watch (view-only) - so opening the + # dashboard needs no token, but it can't edit/delete/exec. + # For write access, still log in with the admin-user token + # (kubectl -n kubernetes-dashboard create token admin-user). + # # --token-ttl=0 was tried here to disable the 15-min idle # timeout, but login broke immediately after that pod came up - # in this dashboard version, 0 appears to mean "expire