User "system:serviceaccount:kube-system:default" cannot list pods in the namespace "default"

[joar]

Steps to reproduce

1. Run kubectl proxy
2. Go to http://localhost:8001/ui

Environment

This is the version info the "SEND FEEDBACK" button automatically included, but it does not seem to provide the correct info. The "About" tab in the dashboard produces the same faulty version info.

Installation method: 
Kubernetes version:
Dashboard version: @@BUILD_DASHBOARD_VERSION
Commit: @@BUILD_GIT_COMMIT

Here's my info:

Kubernetes 1.7.4 on GKE (upgraded from 1.7.3)

• Client certificate: Enabled
• Kubernetes alpha features: Disabled
• Legacy auth: Disabled
• Preemptible, autoscaling nodepool

$ kubectl version --short
Client Version: v1.7.4
Server Version: v1.7.4

Observed result

Dashboard reported Forbidden (403):

User "system:serviceaccount:kube-system:default" cannot list pods in the namespace "default".: "Unknown user \"system:serviceaccount:kube-system:default\"" (get pods)

Comments

The dashboard works fine in another cluster:

$ kubectl version --short
Client Version: v1.7.4
Server Version: v1.6.7

[floreks]

Check other issues for answer i.e. #2326

[joar]

@floreks Thank you, I didn't check the closed issues when searching before posting.

[joar]

Running kubectl apply -f https://git.io/kube-dashboard solved it for me, although I'm not sure if it's the correct solution. Ping #2326.

[dukelyuu]

add this role for dashboard as follow:
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: kubernetes-dashboard
labels:
k8s-app: kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:

• kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system