Skooner is a Kubernetes dashboard that can read and change cluster resources. Its install guide supports service-account tokens, OIDC, and a NodePort access path. The token that a user enters can inherit substantial cluster authority. A ZoomEye title count is useful for finding possible dashboards, but the token's role bindings and lifetime are the security decision.
What the measurement showed
On 2026-11-11 at 19:48 UTC, title="Skooner" returned 1,571 ZoomEye matches with sub_type=all, page 1, and page size 1. The application field returned zero, the body field returned 1,574, and the legacy title="k8dash" candidate returned 64. The product's former name is a reminder that inventory queries need a rename check.
The search is available at ZoomEye. A title match does not prove that a cluster is reachable or that the token exposed on the login screen has cluster-admin rights.
Review the token path
The installation instructions describe a service account and a token secret. A user copies that token into the dashboard login. The dashboard server proxies requests to the Kubernetes API. If the service account is bound to a broad role, every session using the token inherits that authority.
Create a dedicated service account for the dashboard and bind only the roles the operators need. Prefer OIDC and short-lived credentials when the cluster supports them. Do not reuse the cluster-admin token from a bootstrap process as the daily dashboard login. Test read, list, create, and delete operations separately for each role.
Close the NodePort path
The install guide offers a NodePort option for quick access. A NodePort is a network exposure decision, not just a service configuration. Restrict it with network policy, a firewall, or an authenticated proxy. If the dashboard is only for a few administrators, a private address or port-forward is safer than publishing the NodePort.
Test from an untrusted network and confirm that the login page and any API routes are not reachable. Then test from the approved administrative network. Record the ingress path, TLS termination, and authentication method so that a later service change does not silently remove them.
Audit dashboard actions
The dashboard can update YAML, scale workloads, and manage resources. Enable Kubernetes audit logging and review the service account and user identities that appear in the logs. Alert on token creation, role-binding changes, secret reads, and resource changes made through the dashboard namespace.
The 1,571 title matches are not a count of vulnerable clusters. They are a seed for checking token scope and network placement. Skooner is useful when its login token is a narrow, expiring identity and the dashboard is kept on an administrative path.
References
- 1.
- 2.
- 3.
- 4.