nginx: How to enable dashboard on a sub-path?

[colemickens]

This works, reliably:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
  name: dashboard
  namespace: kube-system
spec:
  rules:
  - host: 'dashboard.domain.tld'
    http:
      paths:
      - path: /
        backend:
          serviceName: kubernetes-dashboard-head
          servicePort: 80

On the other hand, this only works with http://domain.tld/dashboard/ and not http://domain.tld/dashboard (note trailing slash). And adding/removing a trailing slash to the 'path' field of the yaml has no effect:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "nginx"
    ingress.kubernetes.io/rewrite-target: "/"
  name: dashboard
  namespace: kube-system
spec:
  rules:
  - host: 'domain.tld'
    http:
      paths:
      - path: /dashboard/
        backend:
          serviceName: kubernetes-dashboard-head
          servicePort: 80

(Note, the delta is the host, the path, and the rewrite-target annotation)

From reading the HTML source of dashboard, I understand why this is happening, but I'm not familiar enough with nginx/ingress to know what the right fix is...

[colemickens]

It looks like when using kubectl proxy, this happens:

--2017-05-03 21:15:54--  http://10.0.0.2:9090/api/v1/namespaces/kube-system/services/kubernetes-dashboard-head/proxy
Connecting to 10.0.0.2:9090... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: /api/v1/namespaces/kube-system/services/kubernetes-dashboard-head/proxy/ [following]
--2017-05-03 21:15:54--  http://10.0.0.2:9090/api/v1/namespaces/kube-system/services/kubernetes-dashboard-head/proxy/
...

I guess I need a way to say "redirect path to path/" (maybe if the path in the spec has a trailing slash?), or an annotation for configuring a manual 301 for a given host/path. Thoughts on either of those @aledbf, or maybe I'm missing a more obvious way of accomplishing this goal?

[theobolo]

Hello @colemickens, you just have to define your Ingress rule like this :

 rules:
  - host: 'domain.tld'
    http:
      paths:
      - path: /dashboard
        backend:
          serviceName: kubernetes-dashboard-head
          servicePort: 80

Just remove the last / at path: /dashboard

Then go to http://domain.tld/dashboard/, should works, i'm using that config too.

[colemickens]

But there's no automatic redirect. If you visit http://domain.tld/dashboard you get dropped on a blank white page.

[delacroixe]

The same happens to me. It doesn't redirect from path: "/whatever" to "/" inside the service. There is any way to redirect from specified path in the ingress file to the root path of the service?

[himikof]

This seems related to issue #646, there are some workarounds there.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[diwakar-s-maurya]

By borrowing idea from #646, following makes dashboard serve at /kube path with tls passthrough. It also redirects /kube to /kube/

cat <<EOF | kubectl apply -f -
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kubernetes-dashboard
  namespace: kube-system
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/secure-backends: "true"
    ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/rewrite-target: "/"
    # adds 301 redirect with trailing slash
    nginx.ingress.kubernetes.io/configuration-snippet: |
      rewrite ^(/kube)$ $1/kube/ permanent;
spec:
  tls:
  - hosts:
    - dashboard.domain.tld
  rules:
  - host: dashboard.domain.tld
    http:
      paths:
      - path: /kube
        backend:
          serviceName: kubernetes-dashboard
          servicePort: 443
EOF

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[bfsmith]

I'm seeing this issue and the rewrite doesn't seem to work with a non-standard port.

I'm using https://localhost:8002/dashboard to try and access the dashboard. The dashboard loads but fails to login, presumably related to how the dashboard does client-side routing. If I add a trailing slash, https://localhost:8002/dashboard/, I can login just fine.

Here's my yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kubernetes-dashboard
  namespace: kube-system
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: "/"
    nginx.ingress.kubernetes.io/add-base-url: "true"
    nginx.ingress.kubernetes.io/secure-backends: "true"
    nginx.ingress.kubernetes.io/configuration-snippet: rewrite ^(/dashboard)$ $1/ permanent;
spec:
  rules:
  - http:
      paths:
      - path: /dashboard
        backend:
          serviceName: kubernetes-dashboard
          servicePort: 443

That configuration takes my https://localhost:8002/dashboard and redirects me to https://localhost/dashboard/. Notice the port is now gone.

Removing "permanent" on the rewrite goes back to login not working.

[petergardfjall]

@bfsmith: I believe your issue (with non-standard port) is addressed by #2059

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[lxcyha]

@bfsmith hi bfsmith, could you tell me how you solved this problem, please? I clicked #2059 but it didn't help .

[Queuecumber]

This should probably be reopened, it's kind of hilarious/sad that it can't handle a missing trailing '/' and it isnt at all obvious what is going wrong. Isn't this a bug on the dashboard side and not the ingress side though?

[mumubin]

The same issue, anyone has an example ingress configuration for subpath consul?

[grantsunny]

Recently I upgraded the image to latest and encountered a regression. In short, new version of image for any reason added a unnecessary <base href="/"> and therefore hard-coded the assumption to have everything start from root directory.

As a result, it is no longer possible to enable the dashboard on sub-path. Please correct if I am wrong.

image kubernetesui/dashboard:v2.0.0-rc6 - it does not work as the base href configuration preventing the dashboard works under any sub path.

<head><base href="/">
  <meta charset="utf-8">
  <title>Kubernetes Dashboard</title>
  <link rel="icon"
        type="image/png"
        href="assets/images/kubernetes-logo.png" />
  <meta name="viewport"
        content="width=device-width">
<link rel="stylesheet" href="styles.fd5645b19f044bd0052c.css"></head>

image kubernetesui/dashboard:v2.0.0-rc5: it works fine

<head>
  <meta charset="utf-8">
  <title>Kubernetes Dashboard</title>
  <link rel="icon"
        type="image/png"
        href="assets/images/kubernetes-logo.png" />
  <meta name="viewport"
        content="width=device-width">
<link rel="stylesheet" href="styles.bb1efa96a359b8cd45d9.css"></head>

[vutny]

kubernetes/dashboard#5017 (comment)

@grantsunny And that issue with hard base href should be already fixed in kubernetes/dashboard#5022 .

[grantsunny]

Thanks @vutny!

[peter-hartmann-emrsn]

Evil issue got this evil fix on my box ... no permanent redirect.

nginx.ingress.kubernetes.io/configuration-snippet: |
    if ($uri = "/dash") { return 302 /dash/; }

Before down-voting this one consider upvoting @Queuecumber 's comment.