{"id":13441349,"url":"https://github.com/skooner-k8s/skooner","last_synced_at":"2025-03-20T11:38:20.918Z","repository":{"id":37423241,"uuid":"175833318","full_name":"skooner-k8s/skooner","owner":"skooner-k8s","description":"Simple Kubernetes real-time dashboard and management.","archived":false,"fork":false,"pushed_at":"2024-05-06T20:56:57.000Z","size":7968,"stargazers_count":1256,"open_issues_count":105,"forks_count":177,"subscribers_count":31,"default_branch":"master","last_synced_at":"2024-05-21T01:06:42.472Z","etag":null,"topics":["hacktoberfest"],"latest_commit_sha":null,"homepage":"http://skooner.io/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/skooner-k8s.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-03-15T14:15:36.000Z","updated_at":"2024-05-28T18:21:22.366Z","dependencies_parsed_at":"2024-05-28T18:21:02.216Z","dependency_job_id":"384d3042-d0b8-4c70-b723-bb82459c049f","html_url":"https://github.com/skooner-k8s/skooner","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skooner-k8s%2Fskooner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skooner-k8s%2Fskooner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skooner-k8s%2Fskooner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skooner-k8s%2Fskooner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/skooner-k8s","download_url":"https://codeload.github.com/skooner-k8s/skooner/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":221759952,"owners_count":16876323,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacktoberfest"],"created_at":"2024-07-31T03:01:32.919Z","updated_at":"2024-10-28T01:30:34.658Z","avatar_url":"https://github.com/skooner-k8s.png","language":"JavaScript","funding_links":[],"categories":["8. Visualization","HarmonyOS","K8S-Tools","JavaScript","hacktoberfest"],"sub_categories":["Dashboarding","Windows Manager"],"readme":"# Skooner - Kubernetes Dashboard\n\n**We are changing our name from k8dash to Skooner! Please bear with us as we update our documentation and codebase to reflect this change. If you previously installed k8dash, you will need to uninstall it from your cluster and install Skooner instead. For most cases this can be done by running the following `kubectl delete deployment,service k8dash`**\n\nSkooner is the easiest way to manage your Kubernetes cluster. Skooner is now a sandbox project of the [Cloud Native Computing Foundation](https://www.cncf.io/sandbox-projects)!\n\n- **Full cluster management**: Namespaces, Nodes, Pods, Replica Sets, Deployments, Storage, RBAC and more\n- **Blazing fast and Always Live**: no need to refresh pages to see the latest cluster status\n- **Quickly visualize cluster health at a glance**: Real time charts help quickly track down poorly performing resources\n- **Easy CRUD and scaling**: plus inline API docs to easily understand what each field does\n- **100% responsive** (runs on your phone/tablet)\n- **Simple OpenID integration**: no special proxies required\n- **Simple installation**: use the provided yaml resources to have skooner up and running in under 1 minute (no, seriously)\n- **See Skooner in action**:\u003cbr\u003e\n  [![Skooner - Kubernetes Dashboard](https://raw.githubusercontent.com/skooner-k8s/skooner/master/docs/videoThumbnail.png)](http://www.youtube.com/watch?v=u-1jGAhAHAM \"Skooner - Kubernetes Dashboard\")\n\n\u003cbr\u003e\n\n## Table of Contents\n\n- [Skooner - Kubernetes Dashboard](#skooner---kubernetes-dashboard)\n  - [Table of Contents](#table-of-contents)\n  - [Prerequisites](#prerequisites)\n  - [Getting Started](#getting-started)\n  - [kubectl proxy](#kubectl-proxy)\n  - [Logging in](#logging-in)\n    - [Service Account Token](#service-account-token)\n    - [OIDC](#oidc)\n    - [NodePort](#nodeport)\n    - [Metrics](#metrics)\n  - [Development](#development)\n  - [Skooner Architecture](#skooner-architecture)\n    - [Server](#server)\n    - [Client](#client)\n  - [License](#license)\n\n## Prerequisites\n\n- A running Kubernetes cluster (e.g., [minikube](https://kubernetes.io/docs/tasks/tools/install-minikube/)), with...\n  - [metrics server](https://github.com/kubernetes-incubator/metrics-server) installed (optional, but strongly recommended)\n  - configuration for [OpenId Connect](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens) authentication (optional)\n\n(Back to [Table of Contents](#table-of-contents))\n\n## Getting Started\n\nDeploy Skooner with something like the following...\n\nNOTE: never trust a file downloaded from the internet. Make sure to review the contents of [kubernetes-skooner.yaml](https://raw.githubusercontent.com/skooner-k8s/skooner/master/kubernetes-skooner.yaml) before running the script below.\n\n```bash\nkubectl apply -f https://raw.githubusercontent.com/skooner-k8s/skooner/master/kubernetes-skooner.yaml\n```\n\nTo access skooner, you must make it publicly visible. If you have an ingress server setup, you can accomplish by adding a route like the following:\n\n```yaml\nkind: Ingress\napiVersion: networking.k8s.io/v1\nmetadata:\n  name: skooner\n  namespace: kube-system\nspec:\n  rules:\n    - host: skooner.example.com\n      http:\n        paths:\n          - path: /\n            backend:\n              service:\n                name: skooner\n                port:\n                  number: 80\n            pathType: ImplementationSpecific\n```\n\nNote: `networking.k8s.io/v1` Ingress is required for Kubernetes v1.22+; `extensions/v1beta1` Ingress is deprecated in v1.14+ and unavailable in v1.22+.\n\n(Back to [Table of Contents](#table-of-contents))\n\n## kubectl proxy\n\nUnfortunately, `kubectl proxy` cannot be used to access Skooner. According to [this comment](https://github.com/kubernetes/kubernetes/issues/38775#issuecomment-277915961), it seems that `kubectl proxy` strips the Authorization header when it proxies requests.\n\n\u003e this is working as expected. \"proxying\" through the apiserver will not get you standard proxy behavior (preserving Authorization headers end-to-end), because the API is not being used as a standard proxy\n\n(Back to [Table of Contents](#table-of-contents))\n\n## Logging in\n\nThere are multiple options for logging into the dashboard: [Service Account Token](#Service-Account-Token), [OIDC](#oidc), and [NodePort](#Nodeport).\n\n### Service Account Token\n\nThe first (and easiest) option is to create a dedicated service account. In the command line:\n\n```bash\n# Create the service account in the current namespace (we assume default)\nkubectl create serviceaccount skooner-sa\n\n# Give that service account root on the cluster\nkubectl create clusterrolebinding skooner-sa --clusterrole=cluster-admin --serviceaccount=default:skooner-sa\n\n# For Kubernetes v1.21 or lower\n# Find the secret that was created to hold the token for the SA\nkubectl get secrets\n\n# Show the contents of the secret to extract the token\nkubectl describe secret skooner-sa-token-xxxxx\n\n# For Kubernetes v1.22 or higher\nkubectl create token skooner-sa\n\n```\n\nCopy the `token` value from the secret, and enter it into the login screen to access the dashboard.\n\n### OIDC\n\nSkooner makes using OpenId Connect for authentication easy. Assuming your cluster is configured to use OIDC, all you need to do is create a secret containing your credentials and apply [kubernetes-skooner-oidc.yaml](https://raw.githubusercontent.com/skooner-k8s/skooner/master/kubernetes-skooner-oidc.yaml).\n\nTo learn more about configuring a cluster for OIDC, check out these great links\n\n- [Authenticating | Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens)\n- [Kubernetes Day 2 Operations: AuthN/AuthZ with OIDC and a Little Help From Keycloak | by Bob Killen | Medium](https://medium.com/@mrbobbytables/kubernetes-day-2-operations-authn-authz-with-oidc-and-a-little-help-from-keycloak-de4ea1bdbbe)\n- [kubectl with OpenID Connect. TL;DR | by Hidetake Iwata | Medium](https://medium.com/@int128/kubectl-with-openid-connect-43120b451672)\n- [kubernetes configure oidc - Google Search](https://www.google.com/search?q=kubernetes+configure+oidc)\n\nYou can deploy Skooner with OIDC support using something like the following script...\n\nNOTE: never trust a file downloaded from the internet. Make sure to review the contents of [kubernetes-skooner-oidc.yaml](https://raw.githubusercontent.com/skooner-k8s/skooner/master/kubernetes-skooner-oidc.yaml) before running the script below.\n\n```bash\nOIDC_URL=\u003cput your endpoint url here... something like https://accounts.google.com\u003e\nOIDC_ID=\u003cput your id here... something like blah-blah-blah.apps.googleusercontent.com\u003e\nOIDC_SECRET=\u003cput your oidc secret here\u003e\n\nkubectl create secret -n kube-system generic skooner \\\n--from-literal=url=$OIDC_URL \\\n--from-literal=id=$OIDC_ID \\\n--from-literal=secret=$OIDC_SECRET\n\nkubectl apply -f https://raw.githubusercontent.com/skooner-k8s/skooner/master/kubernetes-skooner-oidc.yaml\n\n```\n\nAdditionally, you can provide other OIDC options via these environment variables:\n\n- `OIDC_SCOPES`: The default value for this value is `openid email`, but additional scopes can also be added using something like `OIDC_SCOPES=\"openid email groups\"`\n- `OIDC_METADATA`: Skooner uses the excellent [node-openid-client](https://github.com/panva/node-openid-client) module. `OIDC_METADATA` will take a JSON string and pass it to the `Client` constructor. Docs [here](https://github.com/panva/node-openid-client/blob/master/docs/README.md#client). For example, `OIDC_METADATA='{\"token_endpoint_auth_method\":\"client_secret_post\"}`\n\n### NodePort\n\nIf you do not have an ingress server setup, you can utilize a NodePort service as configured in [kubernetes-skooner-nodeport.yaml](https://raw.githubusercontent.com/skooner-k8s/skooner/master/kubernetes-skooner-nodeport.yaml). This is ideal when creating a single node master, or if you want to get up and running as fast as possible.\n\nThis will map Skooner port `4654` to a randomly selected port on the running node. The assigned port can be found using:\n\n```\n$ kubectl get svc --namespace=kube-system\n\nNAME       TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE\nskooner     NodePort    10.107.107.62   \u003cnone\u003e        4654:32565/TCP   1m\n```\n\n### Metrics\n\nSkooner relies heavily on [metrics-server](https://github.com/kubernetes-incubator/metrics-server) to display real time cluster metrics. It is strongly recommended to have `metrics-server` installed to get the best experience from Skooner.\n\n- [Installing metrics-server](https://github.com/kubernetes-incubator/metrics-server)\n- [Running metrics-server with kubeadm](https://medium.com/@waleedkhan91/how-to-configure-metrics-server-on-kubeadm-provisioned-kubernetes-cluster-f755a2ac43a2)\n\n(Back to [Table of Contents](#table-of-contents))\n\n## Development\n\nYou will need:\n\n- A running Kubernetes cluster\n  - Installing and running [minikube](https://kubernetes.io/docs/tasks/tools/install-minikube/) is an easy way to get this.\n  - Once minikube is installed, you can run it with the command `minikube start --driver=docker`\n- Once the cluster is up and running, create some login credentials as described [above](#logging-in)\n\n(Back to [Table of Contents](#table-of-contents))\n\n## Skooner Architecture\n\n### Server\n\nTo run the server, run `npm i` from the `/server` directory to install dependencies and then `npm start` to run the server.\nThe server is a simple express.js server that is primarily responsible for proxying requests to the Kubernetes api server.\n\nDuring development, the server will use whatever is configured in `~/.kube/config` to connect the desired cluster. If you are using minikube, for example, you can run `kubectl config set-context minikube` to get `~/.kube/config` set up correctly.\n\n### Client\n\nThe client is a React application (using TypeScript) with minimal other dependencies.\n\nTo run the client, open a new terminal tab and navigate to the `/client` directory, run `npm i` and then `npm start`. This will open up a browser window to your local Skooner dashboard. If everything compiles correctly, it will load the site and then an error message will pop up `Unhandled Rejection (Error): Api request error: Forbidden...`. The error message has an 'X' in the top righthand corner to close that message. After you close it, you should see the UI where you can enter your token.\n\n(Back to [Table of Contents](#table-of-contents))\n\n## Troubleshooting\n\n### Recommendation for keycloak configuration:\n\n1. Set OIDC_URL to keycloak OpenId endpoint configuration page.\n- `OIDC_URL=https://{keycloak_domain}/realms/foo/.well-known/openid-configuration`\n- Also set `$OIDC_ID` locally with `OIDC_ID={client_id}`\n- You can get `$OIDC_SECRET` from keycloak \n  - (You need to set the Client authentication toggle to be on, for older version of keycloaks you should switch access type to confidential )\n     ![img.png](imgs/OIDC_keycloak_settings.png)\n  - ![img.png](imgs/OIDC_SECTET_img.png)\n\n2. While creating secret, use correct var name and use skooner namespace (by default it's `kube-system`):\n\n```\nkubectl create secret generic skooner \\\n--from-literal=url=$OIDC_URL \\\n--from-literal=id=$OIDC_ID \\\n--from-literal=secret=$OIDC_SECRET \\\n--namespace=kube-system\n```\n\n3. following that, redeploy skooner server with\n   `kubectl apply -f https://raw.githubusercontent.com/skooner-k8s/skooner/master/kubernetes-skooner-oidc.yaml`\n\n4. Make sure skooner is running by checking `kubectl rollout status deploy/skooner --namespace=kube-system`\n   If not, report error with logging in `kubectl describe pod skooner --namespace=kube-system`\n\n5. [Optional] create an ingress for skooner, you can take `provision/keycloak/skooner-ingress.yaml` as an example\n\n6. visit skooner, check if login succeeded\n\n7. [Trouble Shooting] If the api call returns 403 with a message containing some error like: `User \\\"system:anonymous\\\" cannot list resource \\\"selfsubjectrulesreviews\\\" in API group \\\"authorization.k8s.io\\\" at the cluster scope\"` \n   - it means you'll need a cluster role bond. You can take `provision/keycloak/skooner-oidc-patch.yaml` as an example\n   - @elieassi suggests create a serviceaccount separately, I feel like it's more secure but I hadn't test it out. See [this issue](https://github.com/skooner-k8s/skooner/issues/361) for more details\n\n8. If failed, please report both client and server error.\n   Client error: check browser console and send a screenshot\n   Server error: check logs by `kubectl logs deploy/skooner --namespace=kube-system`\n   Note that `RequestError: connect ECONNREFUSED` may indicate a configuration issue rather than Skooner's issue.\n\n## License\n\n[Apache License 2.0](https://raw.githubusercontent.com/skooner-k8s/skooner/master/LICENSE)\n\n[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Findeedeng%2Fk8dash.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Findeedeng%2Fk8dash?ref=badge_large)\n\n(Back to [Table of Contents](#table-of-contents))\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fskooner-k8s%2Fskooner","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fskooner-k8s%2Fskooner","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fskooner-k8s%2Fskooner/lists"}