<p>I'm using Google cloud platform and Kubernetes.</p>
<p>I'm trying to find out which token should I use in order to login to the dashboard and have enough permissions to do as I please.</p>
<p>I created a 3-node Kubernetes 1.8.6 cluster on Google Cloud Platform</p>
<p>my developer desktop is a Mac Pro (late 2013) on macos high sierra 10.13.2 with google-cloud-sdk and kubernetes-cli installed from homebrew.</p>
<pre><code>~ ❯❯❯ kubectl version                                                                                                         ✘ 1
Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;9&quot;, GitVersion:&quot;v1.9.1&quot;, GitCommit:&quot;3a1c9449a956b6026f075fa3134ff92f7d55f812&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2018-01-04T20:00:41Z&quot;, GoVersion:&quot;go1.9.2&quot;, Compiler:&quot;gc&quot;, Platform:&quot;darwin/amd64&quot;}
Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;8+&quot;, GitVersion:&quot;v1.8.6-gke.0&quot;, GitCommit:&quot;ee9a97661f14ee0b1ca31d6edd30480c89347c79&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2018-01-05T03:36:42Z&quot;, GoVersion:&quot;go1.8.3b4&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
</code></pre>
<p>and</p>
<pre><code>~ ❯❯❯ gcloud version
Google Cloud SDK 184.0.0
bq 2.0.28
core 2018.01.05
gsutil 4.28
</code></pre>
<p>I read in the docs that it's not safe to create an admin user for the dashboard, unfortunately the all permissions to the dashboard pod confuses me a bit.</p>
<p>when I execute <code>kubectl get secrets -n kube-system</code> and decode one of the tokens with <code>kubectl get secret &lt;TOKEN_NAME&gt; -n=kube-system -o json | jq -r '.data[&quot;token&quot;]' | base64 -D &gt; user_token.txt</code></p>
<p>and use that to login using the kubectl web proxy I started with the command <code>kubectl proxy</code>, I get lots of permissions errors when I try to view any of the pages in the dashboard web interface. I probably don't use the proper token.. or I need to create a new token.</p>
<p>Is there a way to view the permissions of the tokens so I'll know before hand what I'm actually trying to login with?</p>
<h1>update</h1>
<p>so I ran kubectl to get all the secret tokens in kube-system namespace:</p>
<pre><code>~ ❯❯❯ kubectl get secrets -n kube-system
NAME                                     TYPE                                  DATA      AGE
attachdetach-controller-token-4pp92      kubernetes.io/service-account-token   3         10m
certificate-controller-token-bqnjp       kubernetes.io/service-account-token   3         10m
cloud-provider-token-ltbnh               kubernetes.io/service-account-token   3         10m
cronjob-controller-token-84cl9           kubernetes.io/service-account-token   3         10m
daemon-set-controller-token-ncz5r        kubernetes.io/service-account-token   3         10m
default-token-fpmht                      kubernetes.io/service-account-token   3         10m
deployment-controller-token-4xc8k        kubernetes.io/service-account-token   3         10m
disruption-controller-token-9gdqg        kubernetes.io/service-account-token   3         10m
endpoint-controller-token-gr29m          kubernetes.io/service-account-token   3         10m
event-exporter-sa-token-6klz5            kubernetes.io/service-account-token   3         10m
fluentd-gcp-token-s2kk4                  kubernetes.io/service-account-token   3         10m
generic-garbage-collector-token-tqbqz    kubernetes.io/service-account-token   3         10m
heapster-token-7pgmr                     kubernetes.io/service-account-token   3         10m
horizontal-pod-autoscaler-token-74v57    kubernetes.io/service-account-token   3         10m
job-controller-token-2skhj               kubernetes.io/service-account-token   3         10m
kube-dns-autoscaler-token-wc9gz          kubernetes.io/service-account-token   3         10m
kube-dns-token-nx2tf                     kubernetes.io/service-account-token   3         10m
kubernetes-dashboard-certs               Opaque                                0         10m
kubernetes-dashboard-key-holder          Opaque                                2         9m
kubernetes-dashboard-token-zxp7n         kubernetes.io/service-account-token   3         10m
namespace-controller-token-tz54r         kubernetes.io/service-account-token   3         10m
node-controller-token-m2w7k              kubernetes.io/service-account-token   3         10m
persistent-volume-binder-token-6sfkt     kubernetes.io/service-account-token   3         10m
pod-garbage-collector-token-zqxhd        kubernetes.io/service-account-token   3         10m
replicaset-controller-token-8n6b7        kubernetes.io/service-account-token   3         10m
replication-controller-token-nb2tw       kubernetes.io/service-account-token   3         10m
resourcequota-controller-token-blhfg     kubernetes.io/service-account-token   3         10m
route-controller-token-c5ns6             kubernetes.io/service-account-token   3         10m
service-account-controller-token-zptxc   kubernetes.io/service-account-token   3         10m
service-controller-token-75hht           kubernetes.io/service-account-token   3         10m
statefulset-controller-token-fhpk8       kubernetes.io/service-account-token   3         10m
ttl-controller-token-5vwln               kubernetes.io/service-account-token   3         10m
</code></pre>
<p>then I executed</p>
<pre><code>kubectl get secret kubernetes-dashboard-token-zxp7n -n=kube-system -o json | jq -r '.data[&quot;token&quot;]' | base64 -D &gt; user_token.txt
</code></pre>
<p>and used that token to login.</p>
<p>after login I get the following messages:</p>
<pre><code>warning
configmaps is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list configmaps in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
persistentvolumeclaims is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list persistentvolumeclaims in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
secrets is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list secrets in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
services is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list services in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
ingresses.extensions is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list ingresses.extensions in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
daemonsets.apps is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list daemonsets.apps in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
pods is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list pods in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
events is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list events in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
deployments.apps is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list deployments.apps in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
replicasets.apps is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list replicasets.apps in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
jobs.batch is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list jobs.batch in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
cronjobs.batch is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list cronjobs.batch in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
replicationcontrollers is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list replicationcontrollers in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
close
warning
statefulsets.apps is forbidden: User &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot; cannot list statefulsets.apps in the namespace &quot;default&quot;: Unknown user &quot;system:serviceaccount:kube-system:kubernetes-dashboard&quot;
</code></pre>
<p>any ideas why ?</p>

<p>After you connect the cluster with <strong>gcloud container clusters get-credentials</strong>.
Use the following command to get the access token of current-context</p>

<pre><code>kubectl config view | grep -A10 "name: $(kubectl config current-context)" | awk '$1=="access-token:"{print $2}'
</code></pre>
