How to Secure Access to Kubernetes Dashboard

Securing Access to Kubernetes Dashboard

The Kubernetes Dashboard is a web-based user interface that allows you to manage and monitor your Kubernetes cluster. However, by default, the Dashboard is accessible to anyone with access to the cluster, which can pose a security risk. To secure the access to the Kubernetes Dashboard, you can follow these steps:

1. Enable HTTPS

By default, the Kubernetes Dashboard uses HTTP to communicate with the cluster. To secure the communication, you should enable HTTPS. This can be done by creating a self-signed SSL/TLS certificate or by using a certificate from a trusted Certificate Authority (CA).

Here's an example of how to create a self-signed SSL/TLS certificate using OpenSSL:

# Generate a private key
openssl genrsa -out dashboard.key 2048

# Generate a self-signed certificate
openssl req -x509 -new -nodes -key dashboard.key -subj "/CN=kubernetes-dashboard" -out dashboard.crt

Once you have the certificate and key files, you can configure the Kubernetes Dashboard to use HTTPS by updating the deployment manifest:

apiVersion: v1
kind: Secret
metadata:
  name: kubernetes-dashboard-certs
  namespace: kubernetes-dashboard
type: Opaque
data:
  dashboard.crt: <base64-encoded-certificate>
  dashboard.key: <base64-encoded-private-key>
---
apiVersion: v1
kind: Service
metadata:
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard

In this example, we create a Kubernetes Secret to store the SSL/TLS certificate and private key, and then update the Kubernetes Dashboard Service to use HTTPS on port 443.

graph TD A[Kubernetes Cluster] --> B[Kubernetes Dashboard] B --> C[SSL/TLS Certificate] C --> D[HTTPS] D --> E[Secure Access]

2. Enable Authentication

By default, the Kubernetes Dashboard allows anyone with access to the cluster to access the dashboard. To secure the dashboard, you should enable authentication. There are several authentication methods available, such as:

Basic Authentication: This method allows you to specify a username and password to access the dashboard.
Token-based Authentication: This method allows you to use a token (such as a service account token) to authenticate with the dashboard.
OIDC (OpenID Connect) Authentication: This method allows you to use an external identity provider (such as Google, GitHub, or Azure AD) to authenticate with the dashboard.

Here's an example of how to enable token-based authentication using a service account:

Create a service account in the kubernetes-dashboard namespace:

kubectl create serviceaccount dashboard-admin -n kubernetes-dashboard

Create a ClusterRoleBinding to grant the service account the necessary permissions:

kubectl create clusterrolebinding dashboard-admin -n kubernetes-dashboard \
  --clusterrole=cluster-admin \
  --serviceaccount=kubernetes-dashboard:dashboard-admin

Retrieve the token for the service account:

kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/dashboard-admin -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"

Update the Kubernetes Dashboard deployment to use the service account token for authentication:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: dashboard-admin
  namespace: kubernetes-dashboard
---
apiVersion: v1
kind: Secret
metadata:
  name: dashboard-admin-token
  namespace: kubernetes-dashboard
  annotations:
    kubernetes.io/service-account.name: dashboard-admin
type: kubernetes.io/service-account-token

graph TD A[Kubernetes Cluster] --> B[Kubernetes Dashboard] B --> C[Authentication] C --> D[Service Account Token] D --> E[Secure Access]

By enabling HTTPS and authentication, you can significantly improve the security of your Kubernetes Dashboard and protect your cluster from unauthorized access.

How to secure access to Kubernetes Dashboard?

Securing Access to Kubernetes Dashboard

1. Enable HTTPS

2. Enable Authentication