Kubernetes Dashboard

The official web UI for Kubernetes. Manage workloads, inspect pod logs, scale Deployments, and troubleshoot your cluster — all from a browser with no additional tooling.

What is Kubernetes Dashboard?

Kubernetes Dashboard is the official general-purpose web UI for Kubernetes clusters, maintained by the Kubernetes project under the kubernetes/dashboard GitHub repository. It runs as a Deployment inside your cluster and provides a visual interface for every aspect of cluster state: Deployments, ReplicaSets, StatefulSets, DaemonSets, Jobs, CronJobs, Pods, Services, Ingresses, ConfigMaps, Secrets, PersistentVolumes, Nodes, and Namespaces.

Beyond read-only inspection, the Dashboard supports full CRUD operations — you can create resources by pasting YAML, edit live manifests inline, delete objects, scale Deployments up or down, trigger rolling restarts, view streaming pod logs, and exec into container shells. When paired with Metrics Server it also shows real-time CPU and memory utilization graphs for nodes and pods.

Installation via kubectl apply

Deploy the Dashboard using the official recommended manifest:

# Deploy Kubernetes Dashboard (check GitHub for latest version tag)
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v3.0.0/aio/deploy/recommended.yaml

# Verify pods are running in the kubernetes-dashboard namespace
kubectl get pods -n kubernetes-dashboard

# Expected output:
# NAME                                         READY   STATUS    RESTARTS
# dashboard-metrics-scraper-7b68d5954d-xkz2r   1/1     Running   0
# kubernetes-dashboard-6b8958bdf5-kwxvf         1/1     Running   0

Accessing the Dashboard via kubectl proxy

The safest way to access the Dashboard is through kubectl proxy, which creates an encrypted tunnel to the API server without exposing any ports:

# Start the proxy (runs in foreground, Ctrl+C to stop)
kubectl proxy

# Access the Dashboard at:
# http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/

Creating an Admin Service Account & Token

The Dashboard requires a bearer token for authentication. Create a service account with cluster-admin access:

# 1. Create ServiceAccount
kubectl create serviceaccount admin-user -n kubernetes-dashboard

# 2. Bind to cluster-admin ClusterRole
kubectl create clusterrolebinding admin-user \
  --clusterrole=cluster-admin \
  --serviceaccount=kubernetes-dashboard:admin-user

# 3. Generate a token (Kubernetes 1.24+)
kubectl create token admin-user -n kubernetes-dashboard

# For a long-lived token, create a Secret:
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: admin-user-secret
  namespace: kubernetes-dashboard
  annotations:
    kubernetes.io/service-account.name: admin-user
type: kubernetes.io/service-account-token
EOF

# Retrieve the token value
kubectl get secret admin-user-secret -n kubernetes-dashboard \
  -o jsonpath='{.data.token}' | base64 -d

Managing Workloads from the Dashboard UI

Once logged in, the left sidebar gives you access to all resource types. Key workflows:

• Deployments — view replica counts, image versions, rollout status; click "Scale" to change replicas instantly
• Pod logs — click any Pod → Logs tab for streaming stdout/stderr with search and download
• Exec into container — click Pod → Exec for a web-based shell (requires exec RBAC permission)
• Rolling restart — click Deployment → three-dot menu → Restart to trigger a rolling redeploy without changing image
• Edit live YAML — click any resource → Edit to modify the manifest and apply changes inline
• Create resources — click the "+" button in the top-right to paste or upload YAML/JSON

Installing Metrics Server for CPU/Memory Graphs

# Install Metrics Server
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

# For local clusters (minikube, kind) add --kubelet-insecure-tls flag:
kubectl patch deployment metrics-server -n kube-system \
  --type='json' -p='[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'

# Verify Metrics Server is working
kubectl top nodes
kubectl top pods -A

Kubernetes Dashboard vs Lens vs k9s

Security Best Practices

• Never expose the Dashboard with a NodePort or LoadBalancer service publicly — always use kubectl proxy or a VPN-protected ingress
• Use least-privilege RBAC — create role-specific ServiceAccounts rather than binding everyone to cluster-admin
• Disable anonymous access in the Dashboard deployment args: --enable-insecure-login=false
• Rotate service account tokens regularly; prefer short-lived tokens generated with kubectl create token
• For team access, front the Dashboard with an identity-aware proxy (oauth2-proxy, Pomerium) rather than sharing a cluster-admin token