Kubernetes dashboard error using service account token

Question

I have a Kubernetes cluster with various resources running fine. I am trying to get the Dashboard working but getting the following error when I launch the dashboard and enter the service-account token.

persistentvolumeclaims is forbidden: User "system:serviceaccount:kube-system:kubernetes-dashboard" cannot list resource "persistentvolumeclaims" in API group "" in the namespace "default"

It does not allow the listing of any resources from my cluster (persistent volumes, pods, ingresses etc). My cluster has multiple namespaces.

This is my service-account yaml file:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8s-test # replace with your preferred username
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin # replace with your preferred username
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: dashboard-admin # replace with your preferred username
  namespace: kube-system

Any help is appreciated.

Answer 1

---

FIX: Create a Role Binding for the cluster role.

This should fix the problem:

kubectl delete clusterrole cluster-admin
kubectl delete clusterrolebinding kubernetes-dashboard 
kubectl create clusterrolebinding kubernetes-dashboard --clusterrole=cluster-admin --serviceaccount=kube-system:kubernetes-dashboard

The above command will create a role binding that gives all permissions to all resources.

---

Run the Proxy:

kubectl proxy

---

Check the DashBoard: Please check the URL and port provided by kubectl

http://127.0.0.1:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/persistentvolume?namespace=default

---

More info: Cluster role:

• You can check out the 'cluster-admin' role by:

  kubectl edit clusterrole cluster-admin
  

The problem here is that the serviceaccount 'kubernetes-dashboard' does not have 'list' permissions for the resource 'persistentVolumeClaims'.