Kubernetes Dashboard Token Expired Issue

This article describes an error that occurs when installing the Kubernetes dashboard on Kubernetes 1.24 and how to fix it.

 

1. Error getting a token to log in to kube-dashboard

As of Kubernetes 1.24, creating a service account does not generate a token as secret.

What happend

kubectl get sa token to login dashboard

error: error executing template "{{.data.token | base64decode}}": template: output:1:16: executing "output" at : invalid value; expected string

when create user account

kubectl -n kube-system describe secret

No resources found in kube-system namespace.

kubectl -n kubernetes-dashboard describe secret

No resources found in kubernetes-dashboard namespace.

Why this error occurred & How to fix it

kubectl version is out of date

• Install kubectl on Linux
• Install kubectl on macOS
• Install kubectl on Windows

AWS Docs are out of date

https://github.com/kubernetes/dashboard

GitHub - kubernetes/dashboard: General-purpose web UI for Kubernetes clusters

See the official kubernetes-dashboard github readme.

https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md

GitHub - kubernetes/dashboard: General-purpose web UI for Kubernetes clusters

 

2. Kubernetes Dashboard session expired too quickly.

What happend

Kubernetes dashboard sessions expire after 15 minutes.

Why this error occurred & How to fix it

Expiration time (in seconds) of JWE tokens generated by dashboard. '0' never expires.

kubectl edit deploy kubernetes-dashboard -n kubernetes-dashboard

set token ttl in containers args

--token-ttl=0

 

Name:                   kubernetes-dashboard
Namespace:              kubernetes-dashboard
CreationTimestamp:      Thu, 23 Feb 2023 19:42:48 +0900
Labels:                 k8s-app=kubernetes-dashboard
Annotations:            deployment.kubernetes.io/revision: 2
Selector:               k8s-app=kubernetes-dashboard
Replicas:               1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:           k8s-app=kubernetes-dashboard
  Service Account:  kubernetes-dashboard
  Containers:
   kubernetes-dashboard:
    Image:      kubernetesui/dashboard:v2.4.0
    Port:       8443/TCP
    Host Port:  0/TCP
    Args:
      --auto-generate-certificates
      --namespace=kubernetes-dashboard
      **--token-ttl=0**

https://github.com/kubernetes/dashboard/blob/master/docs/common/dashboard-arguments.md

GitHub - kubernetes/dashboard: General-purpose web UI for Kubernetes clusters

 

 

3. Login token expired too quickly.

Kubernetes Dashboard Token Expired Issue1

What happend

login token expired too quickly.

Why this error occurred & How to fix it

Before v1.22, it generated long-term tokens.

Later versions do not.

Note:

Versions of Kubernetes before v1.22 automatically created long term credentials for accessing the Kubernetes API. This older mechanism was based on creating token Secrets that could then be mounted into running Pods. In more recent versions, including Kubernetes v1.26, API credentials are obtained directly by using the TokenRequest API, and are mounted into Pods using a projected volume. The tokens obtained using this method have bounded lifetimes, and are automatically invalidated when the Pod they are mounted into is deleted.

You can still manually create a service account token Secret; for example, if you need a token that never expires. However, using the TokenRequest subresource to obtain a token to access the API is recommended instead.

https://github.com/kubernetes/dashboard/issues/7444

Kubernetes Dashboard Token Expiration Issue · Issue #7444 · kubernetes/dashboard

kubectl create token with duration parameter.

https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-token-em-

Kubectl Reference Docs

# Request a token with a custom expiration
  kubectl create token myapp --duration 10m

Options:
--duration=0s:
        Requested lifetime of the issued token. The server may return a token with a longer or shorter lifetime.

4. How to Create long-lived token

Kubernetes Dashboard Token Expired Issue2

What happend

The token is valid for up to one day (86400 seconds)

kubectl -n kubernetes-dashboard create token admin-user --duration 720h
Warning: requested expiration of 2592000 seconds shortened to 86400 seconds
eyJhbGciOiJSUzI1NiIsImxxxxxxxxxxxxxxxxxxxxx~~~

Why this error occurred & How to fix it

Manually create a long-lived API token for a ServiceAccount

https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-a-long-lived-api-token-for-a-serviceaccount

Configure Service Accounts for Pods

kubectl apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: admin-user-secret
  namespace: kubernetes-dashboard
  annotations:
    kubernetes.io/service-account.name: admin-user
type: kubernetes.io/service-account-token
EOF

 

 

Describe secret and get token

(Use this!) The token value from this command is the base64 decoded value.

kubectl describe secret/admin-user-secret -n kubernetes-dashboard

 

The token value returned by this command is a base64 encoded value.

kubectl get secret/admin-user-secret -n kubernetes-dashboard -o yaml