KubeLB Dashboard

Overview

KubeLB Dashboard is the web UI for KubeLB. A single chart and binary cover both Community and Enterprise editions — the edition is detected internally at runtime, so there is no separate EE build. Source code and upstream documentation live at kubermatic/kubelb-dashboard; consult that repository for the current feature set.

Screenshots

Cluster overview with resource counts and health:

Dashboard overview

Tenant detail showing enabled features, DNS, certificates, and tunnel configuration:

Tenant detail

Route detail with endpoints, source, DNS/certificate state, and route conditions:

Route detail

WAF policies list (Enterprise Edition):

WAF policies

Install

Install the dashboard from the Kubermatic OCI registry:

helm upgrade kubelb-dashboard \
  oci://quay.io/kubermatic/helm-charts/kubelb-dashboard \
  --version v1.0.0 \
  --namespace kubelb --create-namespace --install

The dashboard is deployed alongside the KubeLB Manager in the kubelb namespace on the management cluster.

Expose via HTTPRoute

Enable the chart’s built-in HTTPRoute (Gateway API v1) with --set flags. It is independent of ingress.enabled — both may be on simultaneously.

helm install kubelb-dashboard oci://quay.io/kubermatic/helm-charts/kubelb-dashboard \
  --set httpRoute.enabled=true \
  --set httpRoute.parentRefs[0].name=kubelb \
  --set httpRoute.parentRefs[0].namespace=kubelb \
  --set httpRoute.hostnames[0]=app.example.com

Equivalent values.yaml:

httpRoute:
  enabled: true
  parentRefs:
    - name: kubelb
      namespace: kubelb
  hostnames:
    - app.example.com

parentRefs must point at an existing Gateway. Omitting httpRoute.rules routes PathPrefix / to the dashboard Service on service.port; override rules for custom matches or backends.

Expose via Ingress

Enable the chart’s built-in Ingress with --set flags:

helm install kubelb-dashboard oci://quay.io/kubermatic/helm-charts/kubelb-dashboard \
  --set ingress.enabled=true \
  --set ingress.className=nginx \
  --set ingress.hosts[0].host=app.example.com \
  --set ingress.hosts[0].paths[0].path=/ \
  --set ingress.hosts[0].paths[0].pathType=Prefix

Equivalent values.yaml:

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: app.example.com
      paths:
        - path: /
          pathType: Prefix

For TLS termination, pair the Ingress with cert-manager and populate ingress.tls and ingress.annotations accordingly.

OIDC Authentication

OIDC is off by default. The underlying API reads the following environment variables:

VariableRequiredDefaultDescription
OIDC_ISSUERYes—OIDC provider issuer URL (e.g. https://dex.example.com)
OIDC_CLIENT_IDYes—OIDC client ID
OIDC_CLIENT_SECRETYes—OIDC client secret
SESSION_SECRETYes—32+ char secret for encrypting session cookies
OIDC_REDIRECT_URINohttp://localhost:{PORT}/auth/callbackCallback URL registered with IdP
OIDC_SCOPESNoopenid email profile groups offline_accessSpace-separated scopes
SESSION_MAX_AGENo86400 (24h)Session cookie max age in seconds

All four required variables must be set together. A partial configuration exits with an error. If none are set, the dashboard runs without authentication.

Enable OIDC via values.yaml:

auth:
  enabled: true
  oidc:
    issuerUrl: https://dex.example.com
    clientId: kubelb-dashboard
  existingSecret: kubelb-dashboard-auth

In production, supply clientSecret and sessionSecret through auth.existingSecret rather than inline values, so secret material stays out of the values file.

Kubeconfig (optional)

For out-of-cluster access to the KubeLB management API, mount a kubeconfig through an existing Secret:

kubeconfig:
  existingSecret: kubelb-dashboard-kubeconfig
  key: kubeconfig

kubeconfig.key is the key inside the Secret that holds the kubeconfig file (default kubeconfig). Leave kubeconfig.existingSecret empty to use the in-cluster service account.

Further Reading