Answers: <p>how we can extract the certificates from the kubeconfig file:</p>
  
  <ol>
  <li>Locate your kubeconfig or config file which you use to run kubectl commands. If you have used my Vagrant file above, you can find it on /etc/kubernetes/admin.conf</li>
  <li><p>You need to export a single file (.p12) with the following two certificates: the client-certificate-data, and the client-key-data. My example runs the command on /home/vagrant. If you run this command on macOS, be sure to change the base64 -d to base64 -D</p>
  
  <pre><code>$ grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d &gt;&gt; kubecfg.crt
  
  
  $ grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d &gt;&gt; kubecfg.key
  
  
  $ openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12
  </code></pre></li>
  <li><p>Import the kubecfg.p12 certificate, reopen your browser, and visit the Kubernetes Dashboard URL. Accept any warning and you should see the authentication page. You can skip the login and check you are not able to perform any task.</p></li>
  <li><p>The following steps have been copied from the Kubernetes Dashboard wiki page (Creating-sample-user)</p>
  
  <pre><code>    1- Create service account
  
          cat &lt;&lt;EOF | kubectl create -f -
          apiVersion: v1
          kind: ServiceAccount
          metadata:
            name: admin-user
            namespace: kube-system
          EOF
          &gt;&gt;
  
      2- Create ClusterRoleBinding
  
          cat &lt;&lt;EOF | kubectl create -f -
          apiVersion: rbac.authorization.k8s.io/v1
          kind: ClusterRoleBinding
          metadata:
            name: admin-user
          roleRef:
            apiGroup: rbac.authorization.k8s.io
            kind: ClusterRole
            name: cluster-admin
          subjects:
          - kind: ServiceAccount
            name: admin-user
            namespace: kube-system
          EOF
          &gt;&gt;
  
      3- Get the Bearer Token. Once you run the following command, copy the token value which you will use on the following step.
  
          $ kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
  
  
      4- Come back to your browser and choose token on the login page. You will need to paste the token value you have copied on the previous step.
  5- Click “SIGN IN” and you should be able to see your Kubernetes Dashboard fully operational.
  </code></pre></li>
  </ol>
  
Answers: CC BY-SA 4.0
Answers: 2018-10-07T11:19:15.857Z
Answers: 2018-10-07T11:19:15.857Z
Answers: BOUKANDOURA Mhamed
Body: <p>I have installed Kubernetes using AWS Minikube scripts - <a href="https://github.com/scholzj/aws-minikube" rel="nofollow noreferrer">https://github.com/scholzj/aws-minikube</a></p>
  
  <p>After installation I am trying to run</p>
  
  <pre><code>kubectl proxy
  </code></pre>
  
  <p>But I am getting this</p>
  
  <blockquote>
    <p>https:kubernetes-dashboard:\" is forbidden: User \"system:anonymous\"
    cannot get services/proxy in the namespace \"kube-system\"</p>
  </blockquote>
  
  <p>I am not even able to list pods because I do not have valid tokens with <code>system.master</code> role. I have no idea how I can create a user or token and authenticate when there is no <code>admin</code> user present on the system yet.</p>
  
  <p>Can you please explain to me?</p>
  
Comments: CC BY-SA 4.0
Comments: 2018-10-01T09:05:02.587Z
Comments: Out of interest, why do this manually using scripts rather than use EKS?
Comments: Caledonia91
Comments: CC BY-SA 4.0
Comments: 2018-10-02T06:13:08.530Z
Comments: I needed just one-node instance, not full cluster. Furthermore I have not known that something like EKS exists.
Comments: Koss645
Tags: <kubernetes>
Title: Kubernetes - unable to login to Dashboard
UserDisplayName: Koss645
ThreadText: # Kubernetes - unable to login to Dashboard
  
  (Asked by: username_0 on 2018-09-29)
  
  I have installed Kubernetes using AWS Minikube scripts - <https://github.com/scholzj/aws-minikube>
  
  After installation I am trying to run
  
  ```
  kubectl proxy
  
  ```
  
  But I am getting this
  
  > https:kubernetes-dashboard:\" is forbidden: User \"system:anonymous\"
  > cannot get services/proxy in the namespace \"kube-system\"
  
  I am not even able to list pods because I do not have valid tokens with `system.master` role. I have no idea how I can create a user or token and authenticate when there is no `admin` user present on the system yet.
  
  Can you please explain to me?
  
  **Tags:** kubernetes
  
  > **Comments:**
  > **username_1**: Out of interest, why do this manually using scripts rather than use EKS?  
  > **username_0**: I needed just one-node instance, not full cluster. Furthermore I have not known that something like EKS exists.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2018-10-07. Score: 2 | Accepted answer
  
  how we can extract the certificates from the kubeconfig file:
  
  1. Locate your kubeconfig or config file which you use to run kubectl commands. If you have used my Vagrant file above, you can find it on /etc/kubernetes/admin.conf
  2. You need to export a single file (.p12) with the following two certificates: the client-certificate-data, and the client-key-data. My example runs the command on /home/vagrant. If you run this command on macOS, be sure to change the base64 -d to base64 -D
  
     ```
     $ grep 'client-certificate-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.crt
  
     $ grep 'client-key-data' ~/.kube/config | head -n 1 | awk '{print $2}' | base64 -d >> kubecfg.key
  
     $ openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12
  
     ```
  3. Import the kubecfg.p12 certificate, reopen your browser, and visit the Kubernetes Dashboard URL. Accept any warning and you should see the authentication page. You can skip the login and check you are not able to perform any task.
  4. The following steps have been copied from the Kubernetes Dashboard wiki page (Creating-sample-user)
  
     ```
         1- Create service account
  
             cat <<EOF | kubectl create -f -
             apiVersion: v1
             kind: ServiceAccount
             metadata:
               name: admin-user
               namespace: kube-system
             EOF
             >>
  
         2- Create ClusterRoleBinding
  
             cat <<EOF | kubectl create -f -
             apiVersion: rbac.authorization.k8s.io/v1
             kind: ClusterRoleBinding
             metadata:
               name: admin-user
             roleRef:
               apiGroup: rbac.authorization.k8s.io
               kind: ClusterRole
               name: cluster-admin
             subjects:
             - kind: ServiceAccount
               name: admin-user
               namespace: kube-system
             EOF
             >>
  
         3- Get the Bearer Token. Once you run the following command, copy the token value which you will use on the following step.
  
             $ kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
  
         4- Come back to your browser and choose token on the login page. You will need to paste the token value you have copied on the previous step.
     5- Click “SIGN IN” and you should be able to see your Kubernetes Dashboard fully operational.
  
     ```
  
  
  ---
  
  