<p>After getting my k8s cluster up and going I faithfully deployed the following WebUI dashboard
using the command:</p>
<pre><code>kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.4/aio/deploy/recommended.yaml
</code></pre>
<p>When I try to access it I get the following error:</p>
<pre><code>Metric client health check failed: an error on the server (&quot;unknown&quot;) has prevented the request from succeeding (get services dashboard-metrics-scraper)
</code></pre>
<p>If I get all the services I get:</p>
<pre><code>k get services --all-namespaces
NAMESPACE              NAME                        TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)         AGE
default                kubernetes                  ClusterIP   10.96.0.1     &lt;none&gt;        443/TCP         8d
kube-system            kube-dns                    ClusterIP   10.96.0.10    &lt;none&gt;        53/UDP,53/TCP   8d
kubernetes-dashboard   dashboard-metrics-scraper   ClusterIP   10.96.0.65    &lt;none&gt;        8000/TCP        6m10s
kubernetes-dashboard   kubernetes-dashboard        ClusterIP   10.96.0.173   &lt;none&gt;        443/TCP         6m10s
</code></pre>
<p>Can someone shed some light? what am I missing?</p>
<p>More Info:
In the dashboard yaml I found these roles:</p>
<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;secrets&quot;]
    resourceNames: [&quot;kubernetes-dashboard-key-holder&quot;, &quot;kubernetes-dashboard-certs&quot;, &quot;kubernetes-dashboard-csrf&quot;]
    verbs: [&quot;get&quot;, &quot;update&quot;, &quot;delete&quot;]
   
 map.
  - apiGroups: [&quot;&quot;]
    resources: [&quot;configmaps&quot;]
    resourceNames: [&quot;kubernetes-dashboard-settings&quot;]
    verbs: [&quot;get&quot;, &quot;update&quot;]
    
  - apiGroups: [&quot;&quot;]
    resources: [&quot;services&quot;]
    resourceNames: [&quot;heapster&quot;, &quot;dashboard-metrics-scraper&quot;]
    verbs: [&quot;proxy&quot;]
  - apiGroups: [&quot;&quot;]
    resources: [&quot;services/proxy&quot;]
    resourceNames: [&quot;heapster&quot;, &quot;http:heapster:&quot;, &quot;https:heapster:&quot;, &quot;dashboard-metrics-scraper&quot;, &quot;http:dashboard-metrics-scraper&quot;]
    verbs: [&quot;get&quot;]

    ---
    
    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
    rules:
      
      - apiGroups: [&quot;metrics.k8s.io&quot;]
        resources: [&quot;pods&quot;, &quot;nodes&quot;]
        verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]
    
    ---
    
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
      name: kubernetes-dashboard
      namespace: kubernetes-dashboard
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: kubernetes-dashboard
    subjects:
      - kind: ServiceAccount
        name: kubernetes-dashboard
        namespace: kubernetes-dashboard
    
    ---
    
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: kubernetes-dashboard
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: kubernetes-dashboard
    subjects:
      - kind: ServiceAccount
        name: kubernetes-dashboard
        namespace: kubernetes-dashboard
</code></pre>
<p>Looks like the kubernetes-dashboard user has access to the metrics service I might be wrong</p>

<p>It looks like the kubernetes-dashboard's serviceaccount doesn't have access to all kubernetes resources (in particular, it can't access the metric server service).</p>
<p>To fix this you should create a new ServiceAccount for the dashboard and give it more permissions.</p>
<p>Here's one that I found on another similar post (<strong>be careful since it will give admin privileges to the dashboard, and whoever uses it will be able to destroy/create new or existing resources on your kubernetes cluster</strong>):</p>
<pre><code>   apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
   name: kubernetes-dashboard
   labels:
       k8s-app: kubernetes-dashboard
roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system
</code></pre>
<p>If you don't have a cluster-admin ServiceAccount, create one following this template:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: kube-system
  labels:
    kubernetes.io/cluster-service: &quot;true&quot;
    addonmanager.kubernetes.io/mode: Reconcile
</code></pre>
<p>Admin ClusterRole:</p>
<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: admin
rules:
  - apiGroups: [&quot;*&quot;]
    resources: [&quot;*&quot;]
    verbs: [&quot;*&quot;]
    nonResourceURLs: [&quot;*&quot;]
</code></pre>
