Answers can be dependent on versions. FYI, I am using K8s v1.20 and Dashboard v2.1.0 First I created a dashboard admin service account via the following dashboardsvcacct.yaml file
apiVersion: v1
kind: ServiceAccount
metadata:
name: dashboard-admin
namespace: kubernetes-dashboard
and applied it to the cluster via
#kubectl apply -f dashboardsvcacct.yaml
#serviceaccount/dashboard-admin created
Then I created a role binding to allow the above service account cluster-admin role access instead of sharing the kubernetes-admin account. Done via the following dashboardrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: dashboard-admin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: dashboard-admin
namespace: kubernetes-dashboard
and applied it to the cluster via
#kubectl apply -f dashboardrolebinding.yaml
#clusterrolebinding.rbac.authorization.k8s.io/dashboard-admin created
Then extracted the token from the newly created dashboard-admin account associated with the kubernetes-dashboard namespace via
#kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep dashboard-admin | awk '{print $1}')
the output includes the token below. I have shortened the token for posting purposes. Note not to include linebreaks when copying/pasting from terminal.
Name: dashboard-admin-token-9pzgf
Namespace: kubernetes-dashboard
Labels: <none>
Annotations: kubernetes.io/service-account.name: dashboard-admin
kubernetes.io/service-account.uid: 7efde521-60fd-40f3-9fe0-2097c123421c
Type: kubernetes.io/service-account-token
Data
====
token: eyJhbGciOiJSUzI1NiIsImtpZCI6Im1OVl<Shortened for posting>
ca.crt: 1066 bytes
namespace: 20 bytes
Copying and pasting the full token from the above output allowed me to access the dashboard via the Token option, but this is a pain to do every time.
The main question was being able to use a Config File option. The config file does not need to contain any X509 certificates as those are not/cannot be used by the dashboard. Also, it is not secure to share out the kubernetes-admin config file entirely which includes the both the certificate and private key. So the config file needed to access the dashboard can be based on the kubernetes-admin config without the kubernetes-admin data, since only the cluster server API target and public ca cert data are needed. The rest of the file is is information from the dashboard-admin service account including the token. The config file needs to look like the below. Note that everything under the "cluster" section will be specific to your install. The "contexts" and "users" section that will be the same, except the token for your install.
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tL<Shortened for posting>
server: https://10.175.0.3:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: dashboard-admin
name: dashboard-admin@kubernetes
current-context: dashboard-admin@kubernetes
kind: Config
preferences: {}
users:
- name: dashboard-admin
user:
token: eyJhbGciOiJSUzI1NiIsImtpZCI6Im1OVl<Same Token as above, Shortened for posting>
Pointing the dashboard UI to that config file allowed me to login.