Kubernetes Dashboard on arschrock

This repository pins the final official Kubernetes Dashboard chart, 7.14.0, directly from its GitHub release with SHA-256 verification. The old Helm index now returns 404 because Kubernetes Dashboard is archived and unmaintained. Upstream recommends migrating to Headlamp; this deployment should therefore be treated as an interim compatibility service, not a long-term platform choice.

Authentication and TLS

The public route at https://kubernetes.brunner.ninja is protected by a namespace-local Traefik forward-auth middleware that uses the shared Authentik embedded outpost. Keeping the middleware local allows Traefik's safer allowCrossNamespace=false setting to remain enabled. Authentik permits only members of authentik Admins. A private nginx proxy then adds a projected token for the existing admin-user service account. Kubernetes issues and rotates that token automatically every hour; it is never stored in Git, a static Secret, Gitea, or Traefik configuration. Supplying the Authorization header makes Dashboard skip its bearer-token login page.

Every Dashboard container retains a CPU request, right-sized to 25m from an observed idle use of roughly 1-2m. Requests are not removed: they still give the scheduler a placement signal while the higher CPU limits leave room for interactive bursts.

This preserves the previous cluster-admin behavior, but Kubernetes audit events identify every Dashboard action as the same service account. Native Authentik OIDC would provide per-user identity, but requires kube-apiserver configuration and another OAuth proxy because this Dashboard has no native OIDC login. Prefer Headlamp with native OIDC when replacing this retired application.

The Authentik application and provider are owned by the adjacent authentik repository. Run its install.sh once before exposing this route; that installer also attaches the provider to the embedded outpost. No Dashboard OAuth client secret is required for forward authentication.

Traefik terminates browser-facing HTTPS. Kong's internal HTTPS listener remains enabled because the auth proxy sends a privileged bearer token to it. Kong's plain HTTP listener is disabled.

Bootstrap and CI/CD

Run ./install.sh once with administrator access. It downloads and verifies the pinned chart, repairs the existing failed Helm release, creates the bootstrap RBAC, and waits for all six deployments. Run ./test.sh for a secret-free chart render and schema validation.

Then run ./create-ci-kubeconfig.sh and store its final line as the Gitea Actions secret KUBE_CONFIG_BASE64. The CI identity can update only named, already-existing Dashboard objects. It cannot read Secrets, edit the admin-user cluster-admin binding, create resources, or delete resources. Deployment readiness is checked by polling those exact object names; the CI identity deliberately has no namespace-wide Deployment list/watch access.

The deploy workflow runs only for main; pull requests and all pushes run the validation job. The chart's generated CSRF Secret is created by the bootstrap Helm installation and deliberately filtered out of the restricted CI render.