Longhorn Dashboard
You expose the longhorn dashboard through a Kubernetes service or ingress controller. This web interface lets your team manage distributed block storage across cluster nodes. Many teams start by forwarding a local port to reach the storage screen. Others set up an ingress rule with basic login keys for the whole team. When these roles stay too broad, any user can delete live volumes by mistake. How the longhorn dashboard works in Kubernetes Longhorn runs as a set of microservices inside your
GitLab Security Dashboard: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You expose the longhorn dashboard through a Kubernetes service or ingress controller. This web interface lets your team manage distributed block storage across cluster nodes. Many teams start by forwarding a local port to reach the storage screen. Others set up an ingress rule with basic login keys for the whole team. When these roles stay too broad, any user can delete live volumes by mistake.
How the longhorn dashboard works in Kubernetes
Longhorn runs as a set of microservices inside your Kubernetes cluster. The user interface service talks to the manager pod to read and write state. It pulls live data from custom resources stored in the cluster control plane. When you open the longhorn dashboard, you see node health and volume status. You can also create snapshots, run backups, and restore data to new volumes. By default, the frontend service stays inside the cluster network for safety. It does not have a built-in login system or user role list. Instead, it relies on your cluster network and ingress rules for user login. Teams must add an external login wall or use port forwarding for local access.
What native storage access solves and where it falls short
Using an ingress controller with a basic login check stops random outside traffic. It keeps the storage interface off the public internet and requires a valid login. Local port forwarding also works well for small teams during initial setup. It uses existing Kubernetes role rules to decide who can reach the service pod. Still, these native methods only check who can open the front door. Once a user logs in, the web interface gives them full storage control. The native view does not limit which volumes a specific developer can delete. It also fails to log which user clicked the delete button on a volume. Shared basic login keys get passed around in team chats and never expire. If an engineer leaves the team, rotating that shared password breaks scripts for everyone. Also, Kubernetes role rules only gate the initial network tunnel to the pod. They do not inspect the actual storage requests sent inside that active session.
Managing storage operations without shared cluster keys
To keep storage safe, teams need controls that work at the request level. Relying on static kubeconfig files on every laptop creates a huge risk surface. Engineers often hold onto admin cluster keys just to check volume health metrics. A better setup separates read views from write actions like deleting a backup. Teams should link every storage action to a single person from their identity provider. When a developer needs to expand a volume, that permission should last minutes. Short access windows stop old keys from sitting idle on developer machines. Detailed logs should record the exact person, time, and target of every change. This gives security teams clear audit trails without blocking daily storage repair work.
GitLab Security Dashboard: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Does the Longhorn UI have built-in user roles?
No, the native web interface does not include a built-in user login system. Any person who reaches the web port gets full control over all storage volumes.
What is the safest way to view storage health?
Keep the frontend service on a private cluster IP and avoid public ingress rules. Use identity-backed access tools that verify user roles before opening a local session.
Can Kubernetes RBAC restrict actions inside the storage UI?
Kubernetes RBAC can block a user from forwarding a port to the UI pod. Once the port opens, RBAC cannot stop that user from deleting volumes inside.