Exposing the Dashboard

Instead of using linkerd dashboard every time you'd like to see what's goingon, you can expose the dashboard via an ingress. This will also expose Grafana.

Nginx

A sample ingress definition is:

  1. apiVersion: v1
  2. kind: Secret
  3. type: Opaque
  4. metadata:
  5.   name: web-ingress-auth
  6.   namespace: linkerd
  7. data:
  8.   auth: YWRtaW46JGFwcjEkbjdDdTZnSGwkRTQ3b2dmN0NPOE5SWWpFakJPa1dNLgoK
  9. ---
  10. apiVersion: extensions/v1beta1
  11. kind: Ingress
  12. metadata:
  13.   name: web-ingress
  14.   namespace: linkerd
  15.   annotations:
  16.     kubernetes.io/ingress.class: "nginx"
  17.     nginx.ingress.kubernetes.io/upstream-vhost: $service_name.$namespace.svc.cluster.local:8084
  18.     nginx.ingress.kubernetes.io/configuration-snippet: |
  19.       proxy_set_header Origin "";
  20.       proxy_hide_header l5d-remote-ip;
  21.       proxy_hide_header l5d-server-id;
  22.     nginx.ingress.kubernetes.io/auth-type: basic
  23.     nginx.ingress.kubernetes.io/auth-secret: web-ingress-auth
  24.     nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"
  25. spec:
  26.   rules:
  27.   - host: dashboard.example.com
  28.     http:
  29.       paths:
  30.       - backend:
  31.           serviceName: linkerd-web
  32.           servicePort: 8084

This exposes the dashboard at dashboard.example.com and protects it with basicauth using admin/admin. Take a look at the ingress-nginxdocumentation for details on how to change the username and password.

Traefik

A sample ingress definition is:

  1. apiVersion: v1
  2. kind: Secret
  3. type: Opaque
  4. metadata:
  5.   name: web-ingress-auth
  6.   namespace: linkerd
  7. data:
  8.   auth: YWRtaW46JGFwcjEkbjdDdTZnSGwkRTQ3b2dmN0NPOE5SWWpFakJPa1dNLgoK
  9. ---
  10. apiVersion: extensions/v1beta1
  11. kind: Ingress
  12. metadata:
  13.   name: web-ingress
  14.   namespace: linkerd
  15.   annotations:
  16.     kubernetes.io/ingress.class: "traefik"
  17.     ingress.kubernetes.io/custom-request-headers: l5d-dst-override:linkerd-web.linkerd.svc.cluster.local:8084
  18.     traefik.ingress.kubernetes.io/auth-type: basic
  19.     traefik.ingress.kubernetes.io/auth-secret: web-ingress-auth
  20. spec:
  21.   rules:
  22.   - host: dashboard.example.com
  23.     http:
  24.       paths:
  25.       - backend:
  26.           serviceName: linkerd-web
  27.           servicePort: 8084

This exposes the dashboard at dashboard.example.com and protects it with basicauth using admin/admin. Take a look at the Traefikdocumentation for details on how to change the username and password.

DNS Rebinding Protection

To prevent DNS-rebinding attacks,the dashboard rejects any request whose Host header is not localhost,127.0.0.1 or the service name linkerd-web.linkerd.svc.

Note that this protection also covers the Grafanadashboard.

The ingress-nginx config above uses thenginx.ingress.kubernetes.io/upstream-vhost annotation to properly set theupstream Host header. Traefik on the other hand doesn't offer that option, soyou'll have to manually set the required Host as explained below.

Tweaking Host Requirement

If your HTTP client (Ingress or otherwise) doesn't allow to rewrite the Hostheader, you can change the validation regexp that the dashboard server uses,which is fed into the linkerd-web deployment via the enforced-host containerargument.

One way of doing that is through Kustomize, as explained in CustomizingInstallation, using an overlaylike this one:

  1. apiVersion: apps/v1
  2. kind: Deployment
  3. metadata:
  4.   name: linkerd-web
  5. spec:
  6.   template:
  7.     spec:
  8.       containers:
  9.       - name: web
  10.         args:
  11.         - -api-addr=linkerd-controller-api.linkerd.svc.cluster.local:8085
  12.         - -grafana-addr=linkerd-grafana.linkerd.svc.cluster.local:3000
  13.         - -controller-namespace=linkerd
  14.         - -log-level=info
  15.         - -enforced-host=^dashboard\.example\.com$

If you want to completely disable the Host header check, use an empty stringfor -enforced-host.