Dashboard: Install to a different namespace broken

[nauxliu]

Environment

AWS Kubernetes: 1.11
Image: kubernetesdashboarddev/kubernetes-dashboard-amd64:head

Steps to reproduce

helm upgrade --install dashboard stable/kubernetes-dashboard --set image.repository=kubernetesdashboarddev/kubernetes-dashboard-amd64 --set image.tag=head --set extraArgs="{--namespace,development}"

Observed result

Pod CrashLoopBackOff with logs

2019/02/13 10:46:40 Starting overwatch
2019/02/13 10:46:40 Using namespace: development
2019/02/13 10:46:40 Using in-cluster config to connect to apiserver
2019/02/13 10:46:40 Using secret token for csrf signing
2019/02/13 10:46:40 Initializing csrf token from kubernetes-dashboard-csrf secret
panic: secrets "kubernetes-dashboard-csrf" is forbidden: User "system:serviceaccount:development:dashboard-kubernetes-dashboard" cannot get secrets in the namespace "development"

goroutine 1 [running]:
github.com/kubernetes/dashboard/src/app/backend/client/csrf.(*csrfTokenManager).init(0xc00059b540)
    /home/travis/build/kubernetes/dashboard/.tmp/backend/src/github.com/kubernetes/dashboard/src/app/backend/client/csrf/manager.go:40 +0x3c7
github.com/kubernetes/dashboard/src/app/backend/client/csrf.NewCsrfTokenManager(0x15b5980, 0xc0005470e0, 0x1, 0x1018d41)
    /home/travis/build/kubernetes/dashboard/.tmp/backend/src/github.com/kubernetes/dashboard/src/app/backend/client/csrf/manager.go:65 +0x5f
github.com/kubernetes/dashboard/src/app/backend/client.(*clientManager).initCSRFKey(0xc000185080)
    /home/travis/build/kubernetes/dashboard/.tmp/backend/src/github.com/kubernetes/dashboard/src/app/backend/client/manager.go:362 +0x8c
github.com/kubernetes/dashboard/src/app/backend/client.(*clientManager).init(0xc000185080)
    /home/travis/build/kubernetes/dashboard/.tmp/backend/src/github.com/kubernetes/dashboard/src/app/backend/client/manager.go:330 +0x47
github.com/kubernetes/dashboard/src/app/backend/client.NewClientManager(0x0, 0x0, 0x0, 0x0, 0x1, 0x0)
    /home/travis/build/kubernetes/dashboard/.tmp/backend/src/github.com/kubernetes/dashboard/src/app/backend/client/manager.go:398 +0x7a
main.main()
    /home/travis/build/kubernetes/dashboard/.tmp/backend/src/github.com/kubernetes/dashboard/src/app/backend/dashboard.go:99 +0x14f

Expected result

no error

Comments

[floreks]

1. We are not responsible for how helm deploys/updates Dashboard.
2. You can not simply move Dashboard to another namespace without moving all secrets/roles/role bindings that are used by the Dashboard.

This is a configuration issue, not a bug.

[chiefy]

I'm having similar issues trying to use a different namespace. I could be wrong, but it looks like v1.10.1 has kube-system hard-coded for some secrets, so the RBAC on a different NS will not work...

I notice on master it appears that a --namespace arg was added? Is there going to be a new release?

[floreks]

Namespace support will be added in a new release. No ETA as it will be a big release with lots of changes. Angular migration is tracked from a different issue.

As we do not officially support different namespace usage, I am closing this.

/close

[k8s-ci-robot]

@floreks: Closing this issue.

In response to this:

Namespace support will be added in a new release. No ETA as it will be a big release with lots of changes. Angular migration is tracked from a different issue.

As we do not officially support different namespace usage, I am closing this.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[seh]

As we do not officially support different namespace usage

For what it's worth, I tested running in a different namespace with the current head container image today, and it worked flawlessly. That's a good sign for what's to come in a supported release.

[lgg42]

As we do not officially support different namespace usage

For what it's worth, I tested running in a different namespace with the current head container image today, and it worked flawlessly. That's a good sign for what's to come in a supported release.

What's your kubernetes version?

[drewwells]

This should be open until the issue is resolved. Dashboard is not a system app, it shouldn't even be running in kube-system.

[maciaszczykm]

Beta release is a couple of days away, it may be pushed even today.