Kubernetes Dashboard只读用户配置：开发者查看Pod日志最佳实践及教程

Great question! Let's tackle both parts of your query clearly and practically.

Short answer: Yes, it absolutely can be a valid part of your operational workflow—when paired with tight access controls.

Here’s the breakdown:

• The Dashboard offers a quick, visual way to pull real-time Pod logs for immediate debugging, which is far more intuitive for some teams than repeatedly running kubectl logs commands in a terminal. It’s perfect for ad-hoc checks when you need to validate a pod’s behavior right away.
• That said, it’s critical to restrict this access to only users who need it (via read-only permissions) to avoid accidental modifications or exposure of sensitive log data. For long-term log retention, advanced filtering, or cross-cluster analysis, you’ll still want dedicated tools like Loki, ELK Stack, or CloudWatch—but the Dashboard fills an excellent niche for real-time, on-the-spot troubleshooting.

Since you already have an admin user set up, let’s walk through creating a read-only user with minimal, necessary permissions:

Step 1: Create a dedicated ServiceAccount #

First, make a dedicated service account for our read-only user. Create a file named dashboard-readonly-sa.yaml with this content:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: dashboard-readonly
  namespace: kubernetes-dashboard # Match the namespace where your Dashboard is deployed

Apply it with this command:

kubectl apply -f dashboard-readonly-sa.yaml

Step 2: Bind the ServiceAccount to a read-only ClusterRole #

Kubernetes has a built-in view ClusterRole that grants read-only access to most core resources (including Pod logs) across the entire cluster. We’ll bind our service account to this role using a ClusterRoleBinding.

Create a file named dashboard-readonly-crb.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboard-readonly-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view # Built-in read-only role
subjects:
- kind: ServiceAccount
  name: dashboard-readonly
  namespace: kubernetes-dashboard

Apply it with:

kubectl apply -f dashboard-readonly-crb.yaml

If you only need read access for a specific namespace (not the whole cluster), replace the ClusterRoleBinding with a RoleBinding targeted at your desired namespace, using the view Role (instead of ClusterRole) for that namespace.

Step 3: Retrieve the user's authentication token #

To log into the Dashboard, you’ll need the token linked to the dashboard-readonly service account. Run this command to fetch it:

kubectl -n kubernetes-dashboard create token dashboard-readonly

Copy the long token string that’s output—this is what you’ll use to log in.

Step 4: Log in to the Dashboard #

Head to your Kubernetes Dashboard login page, select "Token" as the authentication method, paste the token you copied, and click "Sign In".

You’ll now have a fully read-only session: you can view Pod logs, inspect resource details, and monitor cluster state, but you won’t have permission to create, modify, or delete any resources.

内容的提问来源于stack exchange，提问作者Jitendra Patel