<p>What is the Kubernetes version? Is it >1.8 ? (which has RBAC enabled by default).</p>

<p>The error message says that the Kubernetes Dashboard service account is not allowed to list configmaps in default namespace. RBAC by default is deny-all. You need to explicitly grant permissions.</p>

<p>You can create the following <code>ClusterRoleBinding</code> to grant dashboard full admin privileges.</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
  labels:
    k8s-app: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system
</code></pre>

<p>Save the above block into <code>dashboard-rolebinding.yaml</code> and create it on the cluster:</p>

<pre><code>kubectl create -f dashboard-rolebinding.yaml
</code></pre>

<p><strong>IMPORTANT</strong>: Make sure your dashboard is secured from outside before doing this. Otherwise anyone can have complete access to your cluster. Here is a great article about securing  kubernetes dashboard, from Heptio: <a href="https://blog.heptio.com/on-securing-the-kubernetes-dashboard-16b09b1b7aca" rel="nofollow noreferrer">https://blog.heptio.com/on-securing-the-kubernetes-dashboard-16b09b1b7aca</a> writted by Joe Beda himself.</p>

CC BY-SA 3.0
2018-03-04T06:16:21.967Z
2018-03-04T06:16:21.967Z
Shahidh
<p>Back in the day when I ran <code>kubectl proxy</code>, I could login to <a href="http://localhost:8001" rel="nofollow noreferrer">http://localhost:8001</a> immediately, but know a login prompt is shown. When <code>skipped</code> is clicked the following message is shown:</p>

<blockquote>
  <p>configmaps is forbidden: User
  "system:serviceaccount:kube-system:kubernetes-dashboard" cannot list
  configmaps in the namespace "default": Unknown user
  "system:serviceaccount:kube-system:kubernetes-dashboard"</p>
</blockquote>

<p><strong>Attempt to solve the issue</strong></p>

<p>When the kubeconfig is copied, then the login fails as well</p>

<kubernetes><authentication>
How to login to k8s proxy nowadays?
030
# How to login to k8s proxy nowadays?

(Asked by: username_0 on 2018-03-03)

Back in the day when I ran `kubectl proxy`, I could login to <http://localhost:8001> immediately, but know a login prompt is shown. When `skipped` is clicked the following message is shown:

> configmaps is forbidden: User
> "system:serviceaccount:kube-system:kubernetes-dashboard" cannot list
> configmaps in the namespace "default": Unknown user
> "system:serviceaccount:kube-system:kubernetes-dashboard"

**Attempt to solve the issue**

When the kubeconfig is copied, then the login fails as well

**Tags:** kubernetes, authentication


---

## 1 answers

### Answer by username_1 on 2018-03-04. Score: 4 | Accepted answer

What is the Kubernetes version? Is it >1.8 ? (which has RBAC enabled by default).
The error message says that the Kubernetes Dashboard service account is not allowed to list configmaps in default namespace. RBAC by default is deny-all. You need to explicitly grant permissions.
You can create the following ClusterRoleBinding to grant dashboard full admin privileges.
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
  labels:
    k8s-app: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system

Save the above block into dashboard-rolebinding.yaml and create it on the cluster:
kubectl create -f dashboard-rolebinding.yaml

IMPORTANT: Make sure your dashboard is secured from outside before doing this. Otherwise anyone can have complete access to your cluster. Here is a great article about securing  kubernetes dashboard, from Heptio: https://blog.heptio.com/on-securing-the-kubernetes-dashboard-16b09b1b7aca writted by Joe Beda himself.


---

