[EKS] [Dashboard]: Kubernetes services dashboard in AWS console

[cgswong]

Tell us about your request
Kubernetes dashboard, similar to actual kubernetes dashboard as part of the EKS UI in AWS console.

Which service(s) is this request for?
EKS

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
Make is easier to see and manage, within the AWS console, the state of the various kubernetes components, pods and services. Similar to the Kubernetes dashboard. This is part of the poor onboarding experience, as post cluster installation, we do install the Kubernetes dashboard. However, this is less than ideal and requires CLI commands each time to see the dashboard. GKE is much better than EKS in this regard, so this feature will bring parity, if not better (depending on implementation).

Are you currently working around this issue?
Install Kubernetes dashboard post cluster installation, run proxy command each time to view dashboard.

[micahlmartin]

It would definitely be nice to have a built-in dashboard but you could setup an ingress for it so you wouldn't have to run the proxy.

[cgswong]

@micahlmartin That is true! I completely overlooked that aspect. My request still remains though as such a built-in dashboard in the AWS Console would greatly improve the cluster setup experience and for most eliminate having to add the Kubernetes dashboard installation step.

[ghost]

I agree, we have to add the kubernetes dashboard for every cluster we spin up, having it available as part of an EKS spin up in the AWS console would be a tremendous value add and one less thing for us to manage. Or at least a flag to enable it.

[mikehalof]

@dbayendor-cb
I do have the same requirement and need to automated that deployment.
Are you doing that with automation? can you share? It will very helpful for me do not re-invent it

Mike

[ghost]

@mikehalof We deploy the kubernetes dashboard with the current stable helm-chart, kicked off from helmsman into our clusters at build time, and maintained from there. We override values so there's one for the admin that cluster-wide, and one for each team's namespace that has limited RBAC. Then expose the service. Seems like a lot of work. Also, we have to add in heapster to get the sparklines and graphs working. Still waiting for that to be deprecated and use metrics server, which we have installed to handle HPA, scaling, etc.

[tabern]

You can now see Kubernetes API resources and applications running on your Amazon EKS cluster using the AWS Management Console. This makes it easy to visualize and troubleshoot Kubernetes applications using Amazon EKS.

We're starting today with Workloads, and will be rapidly adding more resources and capabilities.

Learn more:

• Announcement
• Blog - Introducing the new Amazon EKS console

Check out the new console and let us know what you think! We'll be closing this issue, if there's a feature or enhancement you'd like to see us build for the new console, please open an issue!

[groodt]

@tabern Is a new IAM permission required to access this? I'm seeing an error that I've never seen before.

 is not authorized to perform: eks:AccessKubernetesApi on resource: arn:aws:eks

[jlbutler]

@groodt if you use a custom policy with granular permissions for EKS console, you'll need to add that one. this is used to bridge the gap from console into cluster. from there, rbac in the cluster takes over, so also ensure the console credentials are present in the cluster auth map. let us know if that doesn't resolve things for you!

[mtparet]

We have a similar issue:

Error loading Namespaces
Unauthorized: Verify you have access to the Kubernetes cluster

We do not use custom policy, I have full admin rights on this AWS account.

[Dudssource]

@mtparet my guess is that you may need to add your IAM role/user to your cluster's aws-auth config map, just like @jlbutler pointed out.

Reference:
https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html

[mtparet]

Ok, before that I didn't need it to manage the cluster.

Again something to do manually...

[Dudssource]

@mtparet unfortunately yes :(
But for example if you are using eksctl to manage your cluster, there's an option to use it to do this for you
(https://eksctl.io/usage/iam-identity-mappings/).
Or if you are a terraform user that rely on the community module it's possible too (map_roles and map_users).
Also there's an issue #185 that targets the hability to manage the aws-auth config map with CloudFormation.

[mreferre]

@mtparet the cluster itself is an AWS object and so IAM roles/users/policies apply. The cluster internal objects (pods, services etc) are Kubernetes objects that needs Kubernetes authorization to access (via adding the IAM role/user to the Kubernetes authentication mechanism). Point taken that this should be a smoother experience.