What is the Tekton Dashboard and CLI (tkn)?

If Tekton Pipelines is the engine room of a ship, the Dashboard is the bridge with its display screens showing engine status, speed, and navigation, while the tkn CLI is the walkie-talkie that lets the chief engineer bark commands from anywhere on the ship. Both provide visibility and control, but one is visual and the other is text-based. Most production teams use both: the Dashboard for at-a-glance monitoring and the CLI for scripted automation and quick troubleshooting.

The Tekton Dashboard is a Kubernetes-native web application that reads Tekton resources directly from the Kubernetes API server and presents them in a user-friendly interface. It shows a list of all Tasks, Pipelines, TaskRuns, and PipelineRuns across namespaces (if permissions allow), displays the DAG visualization of a Pipeline, shows real-time logs for running steps, and allows you to create new TaskRuns and PipelineRuns from the UI. The Dashboard is installed by applying its release YAML and is typically accessed through kubectl port-forward or an Ingress resource. For the payments-api team, the Dashboard provides a single pane of glass where a developer can see all recent pipeline runs, click into a failed run, identify which step failed, and read the error logs without ever touching kubectl.

The Tekton CLI (tkn) is a standalone binary distributed for Linux, macOS, and Windows. It communicates with the Kubernetes API server using the same kubeconfig as kubectl but provides Tekton-specific commands that are more ergonomic than raw kubectl commands. Instead of typing kubectl get pipelinerun -o yaml and parsing the YAML output to find the status, you type tkn pipelinerun list and get a clean table with names, statuses, and durations. The tkn pipeline start command is particularly useful: it creates a PipelineRun interactively, prompting you for parameter values and workspace bindings. The checkout-service team uses tkn pipeline start deploy-pipeline to kick off a deployment, and the CLI prompts them for the Git URL, branch, and target environment before creating the PipelineRun.

In production environments, the Dashboard and CLI serve complementary roles. The user-auth-service team has the Dashboard open on a shared monitor in their team area, showing the status of all pipeline runs. When a run fails, a developer uses tkn taskrun logs to stream the logs from the failed step directly to their terminal, which is faster than navigating the Dashboard UI for debugging. Platform engineers use tkn in shell scripts for automation: a nightly cron job runs tkn pipelinerun delete --keep 50 to clean up old PipelineRuns and prevent the cluster from accumulating thousands of completed run resources that consume etcd storage. The inventory-sync team uses tkn pipeline start in their deployment scripts, passing parameters programmatically rather than through the interactive prompt.

A gotcha worth noting is that the Tekton Dashboard does not provide authentication or authorization out of the box. It inherits the permissions of the service account it runs under, which by default has read access to Tekton resources in the tekton-pipelines namespace. For multi-tenant clusters where different teams should only see their own pipelines, you need to configure RBAC and potentially put the Dashboard behind an authentication proxy like OAuth2 Proxy or Dex. Another limitation is that the Dashboard does not persist logs after a pod is garbage collected by Kubernetes. For long-term log retention, teams integrate Tekton with external logging systems like Elasticsearch or Loki. The tkn CLI shares these limitations since it reads the same data from the Kubernetes API server.