Provide a read-only, LAN-accessible Kubernetes Dashboard with token-based login.
https://k8s.app.lan/https://192.168.1.9:32443/ (direct NodePort)kubernetes-dashboardkubernetes-dashboard-nodeport (TCP 32443 -> 8443)kubernetes-dashboard (TCP 443 -> 8443)k8s.app.lan resolves to kryptovisor (TLS terminator for *.app.lan).kryptovisor Traefik routes k8s.app.lan to https://192.168.1.9:32443.*.app.lan wildcard certificate is presented to clients.Generate a short-lived token on demand:
kubectl -n kubernetes-dashboard create token dashboard-readonly
Kryptovisor Local CA, browsers/CLI will warn; install the CA into the client trust store.