Date: 2026-02-02
Update: 2026-02-10 (added stable k8s.app.lan URL via kryptovisor Traefik)
Provide a read-only, LAN-accessible Kubernetes Dashboard with token-based login.
https://k8s.app.lan/ (TLS terminated by kryptovisor Traefik using *.app.lan wildcard cert)https://<node-ip>:32443 (direct NodePort)kubernetes-dashboard-nodeport (NodePort 32443)kubernetes-dashboardk8s.app.lan resolves to kryptovisor (192.168.1.4) via the *.app.lan wildcard.kryptovisor Traefik routes k8s.app.lan to https://192.168.1.9:32443 (Dashboard NodePort on drg-k8s).dashboard-readonly.kubectl -n kubernetes-dashboard create token dashboard-readonly
In Kubernetes versions where ServiceAccount token secrets are supported (no auto-generation by default), you can create a long-lived token by creating a kubernetes.io/service-account-token secret annotated for the ServiceAccount.
Security note: treat long-lived tokens like passwords. Do not commit them into git or paste them into shared channels.
view ClusterRoledashboard-logs-read ClusterRolesudo KUBECONFIG=/etc/kubernetes/admin.conf \
kubectl -n kube-system patch deployment metrics-server --type='json' \
-p='[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'
sudo KUBECONFIG=/etc/kubernetes/admin.conf kubectl -n kubernetes-dashboard get pods -o wide
sudo KUBECONFIG=/etc/kubernetes/admin.conf kubectl -n kube-system get pods -l k8s-app=metrics-server