The Kubernetes Dashboard provides a web-based UI for cluster management and visibility — useful for visual inspection alongside kubectl's command-line interface. This guide covers setup and securing access appropriately.
What the Dashboard Provides
A visual overview of cluster resources (pods, deployments, services), resource usage graphs, and basic management actions (scaling, viewing logs) — complements kubectl for scenarios where visual browsing is more convenient than command-line queries.
Step 1 — Deploy the Dashboard
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yamlStep 2 — Create a Service Account for Dashboard Access
apiVersion: v1
kind: ServiceAccount
metadata:
name: dashboard-admin
namespace: kubernetes-dashboardStep 3 — Grant Appropriate RBAC Permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: dashboard-admin-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: dashboard-admin
namespace: kubernetes-dashboardSee How to Set Up RBAC (Role-Based Access Control) in Kubernetes — consider whether cluster-admin is genuinely appropriate for your use case, or whether a more limited, read-focused role better fits your actual dashboard usage needs.
Step 4 — Generate an Access Token
kubectl -n kubernetes-dashboard create token dashboard-adminStep 5 — Access the Dashboard Securely (Never Expose Directly to the Internet)
kubectl proxyhttp://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/Access via kubectl proxy (requiring valid kubeconfig credentials) rather than exposing the dashboard via a public-facing Service/Ingress — the dashboard's significant cluster access capability makes public exposure a genuine security risk.
Alternative: Accessing via Port-Forward
kubectl -n kubernetes-dashboard port-forward svc/kubernetes-dashboard 8443:443Using a More Restricted Role for Read-Only Dashboard Access
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: dashboard-viewer-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: view
subjects:
- kind: ServiceAccount
name: dashboard-viewer
namespace: kubernetes-dashboardFor team members who need visibility but not modification capability, bind to the predefined view ClusterRole instead of cluster-admin, following least-privilege principles.
Alternative: Using a CLI-Based Cluster Visualization Tool
Some teams prefer terminal-based cluster visualization tools (k9s and similar) over the web dashboard — often faster for experienced kubectl users, worth considering as an alternative or complement to the web-based dashboard.
Security Considerations
The Dashboard has historically been a target when misconfigured (particularly older versions with default settings exposed publicly) — always require authentication, never expose without access control, and keep the dashboard version updated as part of your regular cluster maintenance.
Common Errors
Dashboard shows "Forbidden" errors for various resources — verify the service account's RBAC bindings actually grant sufficient permissions for the resources you're trying to view/manage; the dashboard reflects whatever access level its associated service account genuinely has.
Continue Reading
- How to Set Up RBAC (Role-Based Access Control) in Kubernetes
- How to Monitor a Kubernetes Cluster with Prometheus and Grafana
- How to Debug a Crashing Pod in Kubernetes
Browse more articles in Kubernetes & Container Orchestration.
