How to login to k8s proxy nowadays?

Question

Back in the day when I ran kubectl proxy, I could login to http://localhost:8001 immediately, but know a login prompt is shown. When skipped is clicked the following message is shown:

configmaps is forbidden: User "system:serviceaccount:kube-system:kubernetes-dashboard" cannot list configmaps in the namespace "default": Unknown user "system:serviceaccount:kube-system:kubernetes-dashboard"

Attempt to solve the issue

When the kubeconfig is copied, then the login fails as well

Answer 1

What is the Kubernetes version? Is it >1.8 ? (which has RBAC enabled by default).

The error message says that the Kubernetes Dashboard service account is not allowed to list configmaps in default namespace. RBAC by default is deny-all. You need to explicitly grant permissions.

You can create the following ClusterRoleBinding to grant dashboard full admin privileges.

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard
  labels:
    k8s-app: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system

Save the above block into dashboard-rolebinding.yaml and create it on the cluster:

kubectl create -f dashboard-rolebinding.yaml

IMPORTANT: Make sure your dashboard is secured from outside before doing this. Otherwise anyone can have complete access to your cluster. Here is a great article about securing kubernetes dashboard, from Heptio: https://blog.heptio.com/on-securing-the-kubernetes-dashboard-16b09b1b7aca writted by Joe Beda himself.