---
title: "Migrate Off the Kubernetes Dashboard: Step by Step | CloudGuys Blog"
description: "Replace the archived Kubernetes Dashboard safely: inventory what it can do, run a replacement side by side, remove it, and clean up the cluster-admin binding it left."
url: "https://cloudguys.io/blog/migrate-off-kubernetes-dashboard-step-by-step"
language: "en"
image: "https://cloudguys.io/_astro/cover.BRwDJUB6.jpg"
published: "2026-10-21T00:00:00.000Z"
modified: "2026-10-21T00:00:00.000Z"
---

ENGINEERING NOTES / KUBERNETES

# Migrate Off the Kubernetes Dashboard: A Step-by-Step Guide

How to replace the archived Kubernetes Dashboard without losing access or leaving cluster-admin bindings behind: inventory, install Headlamp or Berth beside it, verify, remove, and clean up.

CloudGuys Team · · · October 21, 2026 · · · 8 min read · · · Facts checked October 21, 2026 · · · About Berth

![Migrate Off the Kubernetes Dashboard: A Step-by-Step Guide](https://cloudguys.io/_astro/cover.BRwDJUB6_Z5dT83.webp)

The Kubernetes Dashboard is archived, so a cluster that still runs it is running a web UI that will not get security fixes. Moving off it is a small job if you do it in the right order: find out what the Dashboard can do, run the replacement beside it, check the replacement works for your team, and only then remove the old one and its leftovers.

This guide uses [Headlamp](https://headlamp.dev/), the project the Kubernetes Dashboard repository recommends, and shows where [Berth](https://berth.cloudguys.io/self-hosted-kubernetes-dashboard/?utm_source=cloudguys_blog&utm_medium=referral&utm_campaign=migrate-off-kubernetes-dashboard) fits for single-cluster teams. We make Berth, and the [comparison](https://cloudguys.io/blog/kubernetes-dashboard-archived-what-to-use-2026) says which is the better fit for which team. Commands were checked against each project’s documentation on 5 October 2026.

## Before you start

Pick the replacement first. The [decision list](https://cloudguys.io/blog/kubernetes-dashboard-archived-what-to-use-2026) has the short version: Headlamp if you need multi-cluster views, SSO or per-user permissions, Berth if you run one cluster and mostly troubleshoot endpoints and capacity.

Also decide who needs access. The Dashboard login is a bearer token, so “who has access” in practice means “who holds a token.” Write that list down, because the replacement should give each person only what they need.

## Step 1: Inventory what is installed and what it can do

Find the release and how it is exposed:

```sh
helm list -A | grep -i dashboard
kubectl get httproute,ingress,svc -A | grep -i dashboard
```

Save the release’s values now, so you can recreate it if you need to roll back:

```sh
helm get values kubernetes-dashboard -n kubernetes-dashboard > dashboard-values.yaml
```

(`kubernetes-dashboard` is the release and namespace name in the project’s own installation instructions. Yours may differ.)

Then look at what the Dashboard’s accounts can do:

```sh
kubectl get serviceaccounts -n kubernetes-dashboard
kubectl get clusterrolebindings -o wide | grep -i -E "dashboard|admin-user"
```

Pay particular attention to a binding called `admin-user`. The Dashboard’s own “creating a sample user” guide creates a service account with that name and binds it to the `cluster-admin` role, and that guide has been copied into countless runbooks. If your cluster has it, anyone holding a token for that account has full control of the cluster, and it will still be there after you uninstall the Dashboard unless you remove it yourself.

## Step 2: Install the replacement beside the Dashboard

Do not remove anything yet. Running both lets you compare behaviour.

**Option A: Headlamp.** From Headlamp’s in-cluster documentation:

```sh
helm repo add headlamp https://kubernetes-sigs.github.io/headlamp/
helm install my-headlamp headlamp/headlamp --namespace kube-system
```

Headlamp’s documentation says that once it is running you enable access by creating a service account or by setting up OIDC. Its example creates a service account and binds it to `cluster-admin`, with a tip to check the RBAC documentation for more restrictive permissions. Take the tip. A reasonable starting point is the built-in `view` role, adding permissions only when someone needs them:

```sh
kubectl -n kube-system create serviceaccount headlamp-viewer
kubectl create clusterrolebinding headlamp-viewer \
  --serviceaccount=kube-system:headlamp-viewer --clusterrole=view
kubectl create token headlamp-viewer -n kube-system
```

For a team, OIDC is the better answer, because it ties access to people instead of to a shared token. Headlamp’s installation documentation has tutorials for Dex, Keycloak, Cognito and Entra ID.

**Option B: Berth.** From Berth’s installation instructions:

```sh
helm upgrade --install berth oci://ghcr.io/unishsys/charts/berth \
  --namespace berth --create-namespace
kubectl -n berth get secret berth-secrets -o jsonpath='{.data.AUTH_TOKEN}' | base64 -d ; echo
kubectl -n berth port-forward svc/berth 8081:8081
```

Berth is single-cluster and has no per-user permissions: everyone who signs in shares the permissions of the account Berth runs as. That is the right trade for a small team that already trusts everyone with the token, and the wrong one if you need to separate people.

Whichever you choose, keep it behind authentication and, if you expose it, behind TLS. A cluster UI is a cluster credential in a browser tab.

## Step 3: Check the replacement does the jobs your team actually does

Open a short list of real tasks in the replacement while the Dashboard is still up:

1.  Find a pod that is crash looping and read its logs and events.
2.  See which workloads are running with a single replica.
3.  Check where a hostname’s traffic goes and whether its certificate is valid.
4.  Do the one write operation your team uses most (for example a rollout restart), with the role you gave it.

If a task works in the Dashboard and not in the replacement, find out whether it is a missing permission or a missing feature before you decide. A missing permission is a one-line fix. A missing feature is a reason to pick a different tool.

## Step 4: Remove the Dashboard

Once the replacement covers the tasks, take the Dashboard out. If it was exposed through a route or ingress, remove that first so no public path stays open while you work:

```sh
kubectl delete httproute <name> -n <namespace>     # or the ingress, as it applies to you
helm uninstall kubernetes-dashboard -n kubernetes-dashboard
kubectl delete namespace kubernetes-dashboard
```

That removes the Dashboard and the Kong gateway that its chart installed with it. It does not remove cluster-scoped objects that were created outside the chart, so check the bindings you found in step 1:

```sh
kubectl get clusterrolebinding admin-user -o yaml
```

Read the output before you delete anything. If it is the sample binding (service account `admin-user` in the `kubernetes-dashboard` namespace, role `cluster-admin`), delete it:

```sh
kubectl delete clusterrolebinding admin-user
```

Do not delete a binding with that name that you did not create for the Dashboard.

## Step 5: Clean up the places that still point at the old tool

-   **Remove the Helm repository** from your machines, CI and runbooks: `helm repo remove kubernetes-dashboard`. The old URL, `https://kubernetes.github.io/dashboard/`, now returns a 404, and the archived project’s own README still tells readers to add it.
-   **Search your documentation** for `kubernetes-dashboard`, `kong-proxy` and the sample-user commands, and replace them.
-   **Rotate or discard tokens** that were issued for the Dashboard, and make sure nobody saved one in a password manager under a name nobody will recognise next year.
-   **Update your onboarding notes** so new engineers install the replacement, not the tool the old tutorial describes.

## If something goes wrong

Because you saved the release values in step 1, you can put the Dashboard back while you sort things out. Until the replacement is trusted, treat that as temporary: the retired chart repository at `https://kubernetes-retired.github.io/dashboard/` still serves the chart, but the project will not fix vulnerabilities in it.

## Sources

Read on 21 October 2026: the archived Kubernetes Dashboard README and its “creating a sample user” and “accessing the dashboard” documentation; Headlamp’s in-cluster and installation documentation; Berth’s installation instructions. Each command comes from those documents or is a standard `kubectl` and `helm` command. Your cluster’s names and layout will differ, so read each command before you run it, and try the sequence on a non-production cluster first. If a step does not match what you see, tell us and we will correct it.

We checked every command in this guide against the current documentation of each project on 21 October 2026. We did not run them on a cluster for this update, so run them on a disposable cluster first, and tell us if one has drifted.

#Kubernetes · #Kubernetes Dashboard · #Headlamp · #Migration · #RBAC

Share this article

-   [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcloudguys.io%2Fblog%2Fmigrate-off-kubernetes-dashboard-step-by-step%3Futm_source%3Dlinkedin%26utm_medium%3Dsocial "Share on LinkedIn")
-   [X](https://twitter.com/intent/tweet?text=Migrate%20Off%20the%20Kubernetes%20Dashboard%3A%20A%20Step-by-Step%20Guide&url=https%3A%2F%2Fcloudguys.io%2Fblog%2Fmigrate-off-kubernetes-dashboard-step-by-step%3Futm_source%3Dx%26utm_medium%3Dsocial "Share on X")
-   [Reddit](https://www.reddit.com/submit?url=https%3A%2F%2Fcloudguys.io%2Fblog%2Fmigrate-off-kubernetes-dashboard-step-by-step%3Futm_source%3Dreddit%26utm_medium%3Dsocial&title=Migrate%20Off%20the%20Kubernetes%20Dashboard%3A%20A%20Step-by-Step%20Guide "Share on Reddit")
-   [Hacker News](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fcloudguys.io%2Fblog%2Fmigrate-off-kubernetes-dashboard-step-by-step%3Futm_source%3Dhackernews%26utm_medium%3Dsocial&t=Migrate%20Off%20the%20Kubernetes%20Dashboard%3A%20A%20Step-by-Step%20Guide "Share on Hacker News")
-   [Email](mailto:?subject=Migrate%20Off%20the%20Kubernetes%20Dashboard%3A%20A%20Step-by-Step%20Guide&body=Migrate%20Off%20the%20Kubernetes%20Dashboard%3A%20A%20Step-by-Step%20Guide%0A%0Ahttps%3A%2F%2Fcloudguys.io%2Fblog%2Fmigrate-off-kubernetes-dashboard-step-by-step%3Futm_source%3Demail%26utm_medium%3Dsocial "Share on Email")

SEE IT ON YOUR OWN CLUSTER

## Berth: a Kubernetes dashboard  
you run yourself.

Endpoint health, capacity planning, and a read-only AI SRE. Free for small clusters, license checked offline. Discuss your Kubernetes security and architecture with CloudGuys.

[Get a free Community key ↗](https://berth.cloudguys.io/?utm_source=cloudguys_blog&utm_medium=referral&utm_campaign=migrate-off-kubernetes-dashboard-step-by-step) [Talk to CloudGuys ↗](https://cloudguys.io/#architecture-review)

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": [
      "ProfessionalService",
      "Organization"
    ],
    "@id": "https://cloudguys.io/#organization",
    "name": "CloudGuys",
    "url": "https://cloudguys.io/",
    "logo": {
      "@type": "ImageObject",
      "url": "https://cloudguys.io/assets/logo.png",
      "width": 512,
      "height": 512
    },
    "image": "https://cloudguys.io/assets/og-image.png",
    "description": "Security assessments, cloud architecture reviews, and practical remediation across AWS, Google Cloud, Azure, Kubernetes, and infrastructure as code.",
    "email": "hello@cloudguys.io",
    "slogan": "Know your risks. Build a stronger cloud.",
    "areaServed": "Worldwide",
    "hasOfferCatalog": {
      "@type": "OfferCatalog",
      "name": "CloudGuys engagements",
      "itemListElement": [
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Cloud security assessment",
            "url": "https://cloudguys.io/services/cloud-security-assessment",
            "provider": {
              "@id": "https://cloudguys.io/#organization"
            }
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Cloud architecture review",
            "url": "https://cloudguys.io/services/cloud-architecture-review",
            "provider": {
              "@id": "https://cloudguys.io/#organization"
            }
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Security remediation",
            "url": "https://cloudguys.io/services/security-remediation",
            "provider": {
              "@id": "https://cloudguys.io/#organization"
            }
          }
        }
      ]
    },
    "knowsAbout": [
      "DevOps",
      "Kubernetes",
      "Terraform",
      "Cloud migration",
      "Cloud cost optimization",
      "GitOps",
      "Site reliability engineering",
      "Kubernetes dashboard",
      "AI SRE",
      "Kubernetes troubleshooting",
      "AWS",
      "Google Cloud",
      "Azure"
    ],
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "sales",
      "email": "hello@cloudguys.io",
      "availableLanguage": [
        "English"
      ],
      "areaServed": "Worldwide"
    },
    "sameAs": [
      "https://www.linkedin.com/company/agrohitech",
      "https://berth.cloudguys.io",
      "https://tele.cloudguys.io"
    ],
    "owns": [
      {
        "@type": "SoftwareApplication",
        "@id": "https://berth.cloudguys.io/#software",
        "name": "Berth",
        "applicationCategory": "DeveloperApplication",
        "operatingSystem": "Kubernetes",
        "url": "https://berth.cloudguys.io",
        "description": "Berth is a self-hosted Kubernetes dashboard with a read-only AI SRE: endpoint health, capacity planning, guided app exposure, and evidence-based troubleshooting, run in your own cluster."
      },
      {
        "@type": "SoftwareApplication",
        "@id": "https://tele.cloudguys.io/#software",
        "name": "Tele",
        "applicationCategory": "CommunicationApplication",
        "operatingSystem": "Web",
        "url": "https://tele.cloudguys.io",
        "description": "Tele is real-time audio and video call infrastructure: a meeting API for embedding calls in your own application and a managed workspace for teams, deployable in your own cloud or private environment."
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "@id": "https://cloudguys.io/#website",
    "url": "https://cloudguys.io/",
    "name": "CloudGuys",
    "description": "Security and cloud consultancy helping organizations assess risks, improve architecture, and verify remediation.",
    "publisher": {
      "@id": "https://cloudguys.io/#organization"
    },
    "inLanguage": "en"
  },
  {
    "@context": "https://schema.org",
    "@type": "BlogPosting",
    "@id": "https://cloudguys.io/blog/migrate-off-kubernetes-dashboard-step-by-step#article",
    "headline": "Migrate Off the Kubernetes Dashboard: A Step-by-Step Guide",
    "description": "Replace the archived Kubernetes Dashboard safely: inventory what it can do, run a replacement side by side, remove it, and clean up the cluster-admin binding it left.",
    "image": "https://cloudguys.io/_astro/cover.BRwDJUB6.jpg",
    "datePublished": "2026-10-21T00:00:00.000Z",
    "dateModified": "2026-10-21T00:00:00.000Z",
    "author": {
      "@type": "Organization",
      "name": "CloudGuys Team",
      "url": "https://cloudguys.io/"
    },
    "publisher": {
      "@id": "https://cloudguys.io/#organization"
    },
    "mainEntityOfPage": {
      "@type": "WebPage",
      "@id": "https://cloudguys.io/blog/migrate-off-kubernetes-dashboard-step-by-step"
    },
    "articleSection": "Kubernetes",
    "keywords": "Kubernetes, Kubernetes Dashboard, Headlamp, Migration, RBAC",
    "inLanguage": "en",
    "about": {
      "@type": "SoftwareApplication",
      "@id": "https://berth.cloudguys.io/#software",
      "name": "Berth",
      "url": "https://berth.cloudguys.io"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://cloudguys.io/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Blog",
        "item": "https://cloudguys.io/blog"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "Migrate Off the Kubernetes Dashboard: A Step-by-Step Guide",
        "item": "https://cloudguys.io/blog/migrate-off-kubernetes-dashboard-step-by-step"
      }
    ]
  }
]
```