From a22064c176149fbaed8b4e7184c8b4f200c833ec Mon Sep 17 00:00:00 2001
From: Dan Mick <dan.mick@redhat.com>
Date: Wed, 21 Mar 2018 17:53:03 -0700
Subject: [PATCH] Add note about how to enable access to Dashboard

Signed-off-by: Dan Mick <dan.mick@redhat.com>
---
 Documentation/development-environment.md | 43 ++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/Documentation/development-environment.md b/Documentation/development-environment.md
index 610742457..4ba955f46 100644
--- a/Documentation/development-environment.md
+++ b/Documentation/development-environment.md
@@ -120,6 +120,49 @@ k8s-08    Ready     node          2m        v1.9.0+coreos.0
 k8s-09    Ready     node          2m        v1.9.0+coreos.0
 ```
 
+## Running the Kubernetes Dashboard UI
+
+kubespray sets up the Dashboard pod by default, but you must authenticate with a bearer token, even for localhost access with kubectl proxy.  To allow access, one possible solution is to:
+
+1) Create an admin user by creating admin-user.yaml with these contents (and using kubectl -f create admin-user.yaml):
+
+```yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-user
+  namespace: kube-system
+```
+
+2) Grant that user the ClusterRole authorization by creating and applying admin-user-cluster.role.yaml:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: admin-user
+  namespace: kube-system
+```
+
+3) Find the admin-user token in the kube-system namespace:
+
+```bash
+kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
+```
+
+and you can use that token to log into the UI at http://localhost:8001/ui.
+
+(See [https://github.com/kubernetes/dashboard/wiki/Creating-sample-user](https://github.com/kubernetes/dashboard/wiki/Creating-sample-user))
+
+
+
 ## Development workflow on the host
 
 Everything should happen on the host, your development environment will reside on the host machine NOT inside the virtual machines running the Kubernetes cluster.