<p>On kubernetes 1.8.4 I'm trying to give kubernetes users access to our dashboard.</p>

<p>When using the admin context to proxy, all the tokens work when logging into the dashboard. But my users don't have the admin context, only I do, so they use their own context to proxy. And in those situations, they get an error.</p>

<p><strong>Steps:</strong></p>

<ol>
<li>Create a service account for a user, put token in <code>~/.kube/config</code></li>
<li>Give permissions to namespace A to that service account through rolebinding</li>
<li>Switch to that user's context</li>
<li>Do deployments, get pod overview, etc, verify it works. all fine so far</li>
<li>Start <code>kubectl</code> proxy, still in that user's context</li>
<li>Open browser, go to <a href="http://localhost:8001/ui" rel="nofollow noreferrer">http://localhost:8001/ui</a></li>
<li><p>See this in the browser:</p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "
      forbidden: User \"system:serviceaccount:default:&lt;username&gt;\"
          cannot get path \"/ui\"",
  "reason": "Forbidden",
  "details": {},
  "code": 403
}
</code></pre></li>
<li><p>try <a href="http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/" rel="nofollow noreferrer">http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/</a></p></li>
<li><p>See this in the browser:</p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "
      services \"https:kubernetes-dashboard:\" is forbidden:
      User \"system:serviceaccount:default:&lt;username&gt;\" cannot get services/proxy in the namespace \"kube-system\"",
  "reason": "Forbidden",
  "details": {
    "name": "https:kubernetes-dashboard:",
    "kind": "services"
  },
  "code": 403
}
</code></pre></li>
</ol>

<p>Clearly a permission problem. I'm not sure which permission the user needs to have to enable them to access the dashboard though. I'm very hesitant to give them permissions into the kube-system namespace.</p>

<p>When I stop kubectl proxy and then switch to the admin context, start the proxy and retry the same url, I get the dashboard login page.</p>

<p>What do I need to do to get that same result when using the user's context?</p>

<p>I couldn't find a different way other than providing some access to kube-system, so I did using the following role and binding:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: kube-system
  name: user-role-dashboard
rules:
  - apiGroups: [""]
    resources:
      - services
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources:
      - services/proxy
    verbs: ["get", "list", "watch", "create"]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: kube-system
  name: user-binding-dashboard
subjects:
- kind: User
  name: system:serviceaccount:&lt;namespace&gt;:&lt;username&gt;
  apiGroup: ""
roleRef:
  kind: Role
  name: user-role-dashboard
  apiGroup: ""
</code></pre>

<p>Would still like to know whether there is a better way though, your thoughts and suggestions are welcome!</p>
