使用kops在AWS部署K8s集群后Dashboard登录权限问题咨询

Problem Description #

我通过kops在AWS上部署了Kubernetes集群，部署后生成的~/.kube/config结构如下：

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: <data_here>
    name: <cluster_name>
contexts:
- context:
    cluster: <cluster_name>
    user: <cluster_name>
  name: <cluster_name>
current-context: <cluster_name>
kind: Config
preferences: {}
users:
- name: <cluster_name>
  user:
    as-user-extra: {}
    client-certificate-data: <client_certificate_data>
    client-key-data: <client-key-data>
    password: <some-password>
    username: admin
- name:<cluster-name>-basic-auth
  user:
    as-user-extra: {}
    password: <some-password>
    username: admin

创建Dashboard后，执行kubectl proxy并通过localhost访问时遇到两个问题：

1. 选择上述~/.kube/config文件进行认证时提示“Authentication failed”，原因是什么？
2. 使用该文件中的密码登录后，无法以管理员身份操作（例如无法查看Pod的计算资源），该如何处理？

Solutions #

1. Why does authentication fail when using the kubeconfig file?

Let's break down the likely causes:

• Conflicting auth fields in the user entry: Your <cluster_name> user in the kubeconfig has both client certificate credentials (client-certificate-data/client-key-data) and basic auth username/password. The Dashboard tends to prioritize certificate auth first, and this can lead to failures if:
  • The certificate is expired or improperly signed: kops-generated certificates have a finite validity period—if you set up the Dashboard long after cluster deployment, the certificate might have lapsed.
  • The certificate lacks required permissions: The user associated with the certificate might not have the necessary permissions recognized by the Dashboard, or the certificate's Common Name (CN) doesn't align with your cluster's authentication policies.
• Minor kubeconfig formatting error: Notice the second user entry name:<cluster-name>-basic-auth is missing a space after : (it should be name: <cluster-name>-basic-auth). While this might not break the main user entry, malformed YAML can cause parsing issues when the Dashboard reads the config file.

2. How to fix insufficient admin permissions after password login?

The root issue here is that the default Kubernetes Dashboard service account doesn't have cluster-admin privileges. Here's how to grant full admin access:

1. Create a ClusterRoleBinding for the Dashboard service account
   Run this command to bind the kubernetes-dashboard service account (in the kube-system namespace) to the cluster-admin ClusterRole:

   kubectl create clusterrolebinding dashboard-admin --clusterrole=cluster-admin --serviceaccount=kube-system:kubernetes-dashboard
   

2. Verify the binding
   Confirm the binding was created successfully:

   kubectl get clusterrolebindings dashboard-admin
   

3. Re-login to the Dashboard
   First, fix the formatting error in your kubeconfig's <cluster-name>-basic-auth user entry. Then use that user's password to log in. You should now have full admin permissions, including the ability to view Pod resource usage and perform cluster-wide operations.

Extra Tips for Issue 1 #

• Split your kubeconfig into separate user entries for different auth methods: one user using only client certificates, another using only basic auth. This avoids conflicts in credential fields.
• Check your certificate's validity with openssl:

  echo <client_certificate_data> | base64 -d | openssl x509 -text -noout
  

  This will show you the certificate's expiration date and CN, helping you confirm if it's still valid.

内容的提问来源于stack exchange，提问作者pkaramol