Dashboard: Cannot login via token: Uncaught TypeError: t.toKdError is not a function

[zhangzujian]

Environment

Installation method:
Kubernetes version: 1.15.1
Dashboard version: 2.0.0-beta3
Operating system:
Node.js version ('node --version' output):
Go version ('go version' output):

Steps to reproduce

Check the Token, input token (from secret kubernetes-dashboard-token-hb5h9) and click Sign in.

Observed result

An error is reported in browser console:

polyfills.4fc2cacccc1ce951a1ad.js:1 Uncaught TypeError: t.toKdError is not a function
at main.a265afe24a905d94a59f.js:1
at Array.map ()
at e._next (main.a265afe24a905d94a59f.js:1)
at e.__tryOrUnsub (polyfills.4fc2cacccc1ce951a1ad.js:1)
at e.next (polyfills.4fc2cacccc1ce951a1ad.js:1)
at e._next (polyfills.4fc2cacccc1ce951a1ad.js:1)
at e.next (polyfills.4fc2cacccc1ce951a1ad.js:1)
at e.notifyNext (polyfills.4fc2cacccc1ce951a1ad.js:1)
at e._next (polyfills.4fc2cacccc1ce951a1ad.js:1)
at e.next (polyfills.4fc2cacccc1ce951a1ad.js:1)
(anonymous) @ main.a265afe24a905d94a59f.js:1
(anonymous) @ main.a265afe24a905d94a59f.js:1
e.__tryOrUnsub @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e._next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.notifyNext @ polyfills.4fc2cacccc1ce951a1ad.js:1
e._next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.next @ polyfills.4fc2cacccc1ce951a1ad.js:1
(anonymous) @ polyfills.4fc2cacccc1ce951a1ad.js:1
t._trySubscribe @ polyfills.4fc2cacccc1ce951a1ad.js:1
t.subscribe @ polyfills.4fc2cacccc1ce951a1ad.js:1
s @ polyfills.4fc2cacccc1ce951a1ad.js:1
e._innerSub @ polyfills.4fc2cacccc1ce951a1ad.js:1
e._next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.notifyNext @ polyfills.4fc2cacccc1ce951a1ad.js:1
e._next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e._next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e._next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.notifyNext @ polyfills.4fc2cacccc1ce951a1ad.js:1
e._next @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.next @ polyfills.4fc2cacccc1ce951a1ad.js:1
l @ main.a265afe24a905d94a59f.js:1
t.invokeTask @ polyfills.4fc2cacccc1ce951a1ad.js:1
onInvokeTask @ main.a265afe24a905d94a59f.js:1
t.invokeTask @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.runTask @ polyfills.4fc2cacccc1ce951a1ad.js:1
e.invokeTask @ polyfills.4fc2cacccc1ce951a1ad.js:1
m @ polyfills.4fc2cacccc1ce951a1ad.js:1
g @ polyfills.4fc2cacccc1ce951a1ad.js:1
Show 4 more frames

Dashboard logs:

2019/08/05 07:40:22 [2019-08-05T07:40:22Z] Incoming HTTP/2.0 GET /api/v1/settings/global/cani request from 10.0.60.201:56714:
2019/08/05 07:40:22 [2019-08-05T07:40:22Z] Outcoming response to 10.0.60.201:56714 with 200 status code
2019/08/05 07:40:22 Getting application global configuration
2019/08/05 07:40:22 Application configuration {"serverTime":1564990822152}
2019/08/05 07:40:22 [2019-08-05T07:40:22Z] Incoming HTTP/2.0 GET /api/v1/settings/global/cani request from 10.0.60.201:56714:
2019/08/05 07:40:22 [2019-08-05T07:40:22Z] Outcoming response to 10.0.60.201:56714 with 200 status code
2019/08/05 07:40:22 [2019-08-05T07:40:22Z] Incoming HTTP/2.0 GET /api/v1/login/status request from 10.0.60.201:56714:
2019/08/05 07:40:22 [2019-08-05T07:40:22Z] Outcoming response to 10.0.60.201:56714 with 200 status code
2019/08/05 07:40:22 [2019-08-05T07:40:22Z] Incoming HTTP/2.0 GET /api/v1/login/skippable request from 10.0.60.201:56714:
2019/08/05 07:40:22 [2019-08-05T07:40:22Z] Outcoming response to 10.0.60.201:56714 with 200 status code
2019/08/05 07:40:22 [2019-08-05T07:40:22Z] Incoming HTTP/2.0 GET /api/v1/login/modes request from 10.0.60.201:56714:
2019/08/05 07:40:22 [2019-08-05T07:40:22Z] Outcoming response to 10.0.60.201:56714 with 200 status code
2019/08/05 07:40:36 [2019-08-05T07:40:36Z] Incoming HTTP/2.0 GET /api/v1/csrftoken/login request from 10.0.60.201:56714: { contents hidden }
2019/08/05 07:40:36 [2019-08-05T07:40:36Z] Outcoming response to 10.0.60.201:56714 with 200 status code
2019/08/05 07:40:36 [2019-08-05T07:40:36Z] Incoming HTTP/2.0 POST /api/v1/login request from 10.0.60.201:56714: { contents hidden }
2019/08/05 07:40:36 Non-critical error occurred during resource retrieval: the server has asked for the client to provide credentials
2019/08/05 07:40:36 [2019-08-05T07:40:36Z] Outcoming response to 10.0.60.201:56714 with 200 status code

Expected result

Comments

[ctrysbita]

Same problem, but work after clear the cache.

[luisalexandre19]

Same problem too!

[brookssw]

Also experiencing this. I get this error in the following circumstances:

Using OIDC id-token
Using an otherwise valid token that I've deliberately left one letter off, in order to invalidate it. Perhaps this error is indicative of an invalid and/or unauthorized token?

[ridhoq]

My team of 15 people reproduces this issue across the board. We are using the kubeconfig authentication option. We use AKS with the Azure RBAC controls which causes our kubeconfig to look like the below.

- name: clusterUser_rg-bh-dev-aks_aks-bh-dev
  user:
    auth-provider:
      config:
        access-token: xxxxxxxx
        apiserver-id: xxxxxxxx
        client-id: xxxxxxxx
        environment: AzurePublicCloud
        expires-in: "3599"
        expires-on: "1566838151"
        refresh-token: xxxxxxxx
        tenant-id: xxxxxxxx

One interesting workaround I found is that when I change the namespace using the kubens utility to a different namespace and then attempt the log in, I don't see the error and I log in as expected. kubens does modify the kubeconfig, but I don't know why that would affect the log in.

[floreks]

All of these issues are related to the wrong way of authenticating. Using anything but a token in the kubeconfig file will result in an error. We will handle typescript error, but the real issue is that you are trying to use unsupported kubeconfig auth method.

https://github.com/kubernetes/dashboard/wiki/Access-control#kubeconfig

[brookssw]

I would agree, however I'm selecting the "token" method each and every time this occurs, not the kubeconfig method. I can attempt to record a screen capture demonstration if that would be useful.

[floreks]

In all those scenarios it means that credentials are invalid. It only fails to get info from error structure due to wrong method usage.

[UdyW]

1. Create kubectl service account
   kubectl create serviceaccount yourname

2. Get associated secret
   kubectl get serviceaccounts udy -o yaml
   This will output
   apiVersion: v1
kind: ServiceAccount
metadata:
creationTimestamp: "2019-09-17T10:36:09Z"
name: yourname
namespace: default
resourceVersion: "10009"
selfLink: /api/v1/namespaces/default/serviceaccounts/name
uid: f6052bbe-d93454-11e9-bcb5-4544484
secrets:
- name: your-token-qpb898

3. Get secrets -name (your-token-qpb898) from above and run
   kubectl get secret your-token-qpb898 -o yaml

4.This will return a long Base64 token ZXIKaad........Fdw==

5.Copy it over to any Base64 decoder (https://www.base64decode.org/) and decode it.

1. Copy the decoded token and put it in the login page.

You should be able to get in.