Back in the day when I ran kubectl proxy, I could login to http://localhost:8001 immediately, but know a login prompt is shown. When skipped is clicked the following message is shown:

configmaps is forbidden: User "system:serviceaccount:kube-system:kubernetes-dashboard" cannot list configmaps in the namespace "default": Unknown user "system:serviceaccount:kube-system:kubernetes-dashboard"

Attempt to solve the issue

When the kubeconfig is copied, then the login fails as well

1 Answer 1


What is the Kubernetes version? Is it >1.8 ? (which has RBAC enabled by default).

The error message says that the Kubernetes Dashboard service account is not allowed to list configmaps in default namespace. RBAC by default is deny-all. You need to explicitly grant permissions.

You can create the following ClusterRoleBinding to grant dashboard full admin privileges.

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
  name: kubernetes-dashboard
    k8s-app: kubernetes-dashboard
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system

Save the above block into dashboard-rolebinding.yaml and create it on the cluster:

kubectl create -f dashboard-rolebinding.yaml

IMPORTANT: Make sure your dashboard is secured from outside before doing this. Otherwise anyone can have complete access to your cluster. Here is a great article about securing kubernetes dashboard, from Heptio: https://blog.heptio.com/on-securing-the-kubernetes-dashboard-16b09b1b7aca writted by Joe Beda himself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.