5

enter image description here

I get "is forbidden" all over the dashboard site in Kubernetes*(See image)

To reproduce:

  1. Create a Google Kubernetes Cluster via the site, not from shell.

  2. Select Kubernetes version 1.8.6

  3. Open shell via the connect button: gcloud container clusters get-credentials cluster-1 --zone us-central1-a --project awear-cloud

  4. Kubectl proxy

  5. echo http://127.0.0.1:8001/ui
  6. click the link from echo

Note: also tried: http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/

Do you know why?

Chris G.
  • 23,930
  • 48
  • 177
  • 302

2 Answers2

4

1 - Create a file sa.yaml and paste the contents below into it.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system

2 - Apply it - kubectl apply -f sa.yaml

3 - Create a file rbac.yaml and paste the contents below into it.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system

4 - Apply it - kubectl apply -f rbac.yaml

5 - Now, login to your dashboard.

Let me know if this works.

Tushar Sonawane
  • 41
  • 4
  • 1
    It would be great if you also explain what are you doing and why. Thanks for the answer anyway. – PhoneixS Jun 26 '20 at 07:46
  • A complete explanation of this can be found [here](https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md) – HDubz Dec 15 '21 at 18:02
1

It looks like your cluster is RBAC enabled and the dashboard is missing a service account defined in the dashboard pod(s). You should be able to easily mitigate this issue by adding this SA and it's Roles/Bindings. Why is it not created in the first place is a mystery for me, unless you maybe specified something like ie. legacy auth.

Radek 'Goblin' Pieczonka
  • 21,554
  • 7
  • 52
  • 48
  • A related reference to this answer: https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md – Omkar Dec 07 '20 at 13:42