Tekton Dashboard read-only install issue

[2020testuser]

Expected behavior

As an admin user, installation of Tekton Pipeline and Tekton Dashboard read-only in Kubernetes must be successful and non-admin users must be able to launch and view their Pipelines in Tekton Dashboard.

Actual behavior

As an admin user, installing Tekton Dashboard read-only (and the plain yaml as well) in Kubernetes resulted in an error.

Steps to reproduce the pro

1. Install Tekton Pipeline 0.11.x as an admin user in Kubernetes
2. Make sure Tekton Pipeline works fine by running Taskruns/Pipelines
3. Install Tekton Dashboard v as an admin user
4. The below error appears.
    kubectl apply -f tekton-dashboard-readonly.yaml customresourcedefinition.apiextensions.k8s.io/extensions.dashboard.tekton.dev unchanged serviceaccount/tekton-dashboard unchanged clusterrole.rbac.authorization.k8s.io/tekton-dashboard-minimal unchanged clusterrolebinding.rbac.authorization.k8s.io/tekton-dashboard-minimal unchanged service/tekton-dashboard unchanged The Deployment "tekton-dashboard" is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{"app.kubernetes.io/component":"dashboard", "app.kubernetes.io/instance":"default", "app.kubernetes.io/name":"dashboard", "app.kubernetes.io/part-of":"tekton-dashboard"}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: field is immutable

Environment

• Kubernetes Platform:
  0.16.x

• Tekton Pipelines version:
  0.11.x

• Tekton Triggers version:
  Didn't install it

• Tekton Dashboard version:
  0.6.1

Additional Info

Tried installing as non-admin user and got many errors.
Questions:

1. Can Kubernetes admin user ONLY install Tekton Dashboard? If so, how it can be accessed by all non-admin users who have access only to their namespace(s)?
2. Non-admin user must be able to launch Tekton Dashboard and install secrets in their namespaces?

It would be good to include more details in the documentation. Any details to resolve the above would be very helpful. Thanks!

[AlanGreene]

How are you installing the dashboard? This looks very similar to the breaking change mentioned in #1327 but that's not included in a release yet so should only be encountered on master or using a nightly build:

This will introduce a breaking change when trying to update deployments as label selectors have changed.

In this case the deployment would need to be deleted before applying the new version.

You mentioned dashboard v0.6.1 in the description.

• Was this from the release or another source?
• Which version were you updating from?

[2020testuser]

@AlanGreene , I installed Tekton Dashboard by following the steps in the link -https://github.com/tektoncd/dashboard
I tried with the latest version. Since, it didn't work, tried to install the previous version and no luck.
kubectl apply --filename https://github.com/tektoncd/dashboard/releases/download/v0.6.1/tekton-dashboard-release.yaml
Let me know if you need any additional information. Thanks!

[AlanGreene]

From the error in the issue description it looks like you had either a nightly build or a local build from master installed at some point which contains the change from #1327. As I mentioned above this introduces a breaking change.

"app.kubernetes.io/component":"dashboard", "app.kubernetes.io/instance":"default", "app.kubernetes.io/name":"dashboard", "app.kubernetes.io/part-of":"tekton-dashboard"

These labels are not present in any released dashboard version.

To resolve this error please delete the dashboard deployment and you should then be able to re-install the 0.6.1 release.

kubectl delete deployment -n <dashboard-install-namespace> tekton-dashboard

[2020testuser]

@AlanGreene , So, if an admin user (who only have access to tekton pipeline namespace) can only install the dashboard, can non-admin user use it? If so, could you provide details on how the non-admin user can access the dashboard? Can we have the dashboard running forever (may be similar to a service)? More details would be helpful. Thanks!

[AlanGreene]

Did deleting the deployment and re-installing resolve your issue?

For your other questions:

can non-admin user use it?

Yes. There are a number of ways users can access the dashboard, which one you use depends on your specific requirements. See the README for details of accessing it via kubectl proxy and kubectl port-forward: https://github.com/tektoncd/dashboard/#accessing-the-dashboard

You may also choose to expose the dashboard via a route or ingress, see https://github.com/tektoncd/dashboard/#optionally-set-up-the-ingress-endpoint for an example of one approach to doing this.

Can we have the dashboard running forever

Yes this is how it works by default. Installing the dashboard creates a deployment that will ensure the dashboard pod remains running as long as you wish.

[2020testuser]

@AlanGreene , Thanks Much! Since, other users were using the pipeline, I didn't do any reinstall yet. Slated for the weekend work. Will let you know.

[2020testuser]

@AlanGreene - Below are my test results. Could you please let me know what I'm missing.

1. Deleted the dashboard deployment and uninstalled tekton-dashboard from pods and other places in Kubernetes.
2. As an admin user , installed tekton-dashboard in namespace tekton-pipelines.
3. Performed the steps in 'Optionally set up the Ingress endpoint' in link . In the tekton-dashboard pod, using port forward, was able to launch tekton-dashboard as a new url (localhost:) This worked.

My questions are

1. In Kubernetes Dashboard, under Ingress, I can see tekton dashboard. But, when I click the end point, nothing happens. How can I launch from the ingress?

2. Since, I installed tekton dashboard in namespace - tekton-pipelines, as an admin user, I was able to launch tekton-dashboard in a seperate url (using tekton-dashboard pod port forward and url select from there). However, the non-admin user was unable to access the tekton-dashboard ?

3. Tried to install tekton-dashboard as a non-admin user in non-admin user's dashboard (say, testuser-ns). The installation failed as the non-admin user doesn't have access to the tekton-dashboard namespace.

All I'm trying to do is get a non-admin user to launch the dashboard and use it in his/her own namespace. Thanks!

[eddycharly]

Are you trying to install from master ?

The behavior you're experiencing was introduced here: #1327

Upgrading an already deployed release will not work, you will need to delete the Service and Deployment before deploying the new version.

[AlanGreene]

If the non-admin users cannot access the tekton-pipelines namespace you would need to expose it via ingress instead as they won't be able to use the proxy or port-forward methods.

Bear in mind that if you're installing the dashboard in read-write mode (default), any user who can access the dashboard can perform actions with the same permissions as the ServiceAccount used by the dashboard. This means they could potentially be able to create PipelineRuns, pods, and other resources in other namespaces.

How you configure and expose the ingress will depend on your environment.

See #1018 for discussions about installing a namespace-scoped dashboard. This is something we're currently considering adding and may be of interest for your use case.

@eddycharly the issue related to #1327 was addressed above and already resolved. Thanks

[2020testuser]

@AlanGreene - Sorry. Revisiting this issue again.

Regarding your below note on read-write mode, if I install in read-only mode as admin user and configure ingress, can all non-admin users access Dashboard in read-only mode?

Bear in mind that if you're installing the dashboard in read-write mode (default), any user who
can access the dashboard can perform actions with the same permissions as the
ServiceAccount used by the dashboard. This means they could potentially be able to create
PipelineRuns, pods, and other resources in other namespaces.

See #1018 for discussions about installing a namespace-scoped dashboard. This is something
we're currently considering adding and may be of interest for your use case.

I really need namespace-scoped dashboards as this is what meet our needs. Could you please let me know when this would be available?
Thanks!

[eddycharly]

Regarding your below note on read-write mode, if I install in read-only mode as admin user and configure ingress, can all non-admin users access Dashboard in read-only mode?

Right, read-only vs read-write is an install choice not depending on the user accessing the dashboard. Same for all.

I really need namespace-scoped dashboards as this is what meet our needs

This is currently being worked on here #1371. This needs review and testing but most of the things have been implemented.
Hopefully it will be available in a not so distant future 🤞

[2020testuser]

@eddycharly - Thanks!

Even if I install in read-only mode (which needs admin user to install) ,still the non-admin user need to have access to the 'tekton-pipeline' namespace to view the Tekton dashboard. Could you please confirm? Is there any way to grant 'read-only' access to a namespace ? If so, for time-being, I can grant read-only access to the 'tekton-pipeline' namespace so they can view their pipelines.

I tested reinstalling Tekton Dashboard in read-only mode.
ip=$(ifconfig | grep netmask | sed -n 2p | cut -d ' ' -f2) ` returns nothing now (and was working before). I need to do in dashboard manually and retry after uninstall with install.

Hopefully it will be available in a not so distant future 🤞
Super! Thanks! Looking forward to that as each user (non-admin) can use the Tekton Dashboard to perform Tekton related operations in their namespace.

[eddycharly]

the non-admin user need to have access to the 'tekton-pipeline' namespace to view the Tekton dashboard. Could you please confirm?

Not sure about your setup, you should have an ingress to allow incoming traffic to the dashboard. Are you talking about kubectl port-forward ?

ip=$(ifconfig | grep netmask | sed -n 2p | cut -d ' ' -f2) returns nothing now

What are you trying to do exactly ?

[2020testuser]

@eddycharly ,
I'm trying to configure ingress for Tekton Dashboard (in read-only mode) , so non-admin users can at least view their pipelines.

This is what I'm trying to do.
As an admin user, I installed Tekton Dashboard in read-only mode in Tekton Pipeline namespace. I'm trying to set Ingress using the below steps in link so I can provide the dashboard url to non-admin users (who don't have access to Tekton Pipeline namespace) to view their Pipelines in their namespace. I believe I need to give read-only access to tekton pipeline namespace to non-admin users.
Could you please confirm?

`Optionally set up the Ingress endpoint

Create the Ingress:

kubectl apply ingress/basic-dashboard-ingress.yaml

Retrieve a publicly available IP address (in this case running on a laptop connected to a public network):

ip=$(ifconfig | grep netmask | sed -n 2p | cut -d ' ' -f2)
`

[eddycharly]

The idea here is that you configure an Ingress in your cluster. The ingress itself does nothing, you will need an ingress controller to make the ingress useful (nginx-ingress for example).
Do you have an ingress controller installed ?
Is your ingress controller exposed ?

you can use the freely available nip.io service

Once the ingress/ingress controller is ok, you will need a dns record to point to your ingress controller, this is where the link you're trying to follow suggests using nip.io.
You can also simply edit your /etc/hosts if you want.

I believe I need to give read-only access to tekton pipeline namespace to non-admin users.

Nope, when all this is setup correctly the dashboard will work like any other website, using regular http requests.
No need to give any access on a namespace, this is just http.

To summarize, things will work like this:

• user enters the dashboard url in his browser
• the target ip is looked up from the url (by dns or /etc/hosts)
• the request goes to your ingress controller
• the ingress controller checks the host of the request and matches the corresponding ingress
• the request is forwarded to the dashboard service

There are a lot of things going on here and there is no single solution, it will depend on your infrastructure for some parts.

How is your cluster built ?

[2020testuser]

@eddycharly - Sorry for delayed reply. Cluster is on Linux VM and I'm accessing the cluster from my machine using kubectl. I'll retry again and get back on this. Thanks for all your help.

[eddycharly]

Ok, don't hesitate if you need more help.
Setting up an ingress should not need kubectl at all.

I will try to make another doc, potentially using helm so that it is simpler to get something up and running.

[2020testuser]

@eddycharly - Sorry.I meant using kubectl commands to deploy to Kubernetes (my pipelines). Looking forward to your documentation. For now, will retest and get back. Thanks!

[AlanGreene]

Closing as there doesn't appear to be any additional action required for the Dashboard. Let me know if I'm mistaken.