<p>I have a Kubernetes cluster with various resources running fine. I am trying to get the Dashboard working but getting the following error when I launch the dashboard and enter the service-account token.</p>

<blockquote>
  <p>persistentvolumeclaims is forbidden: User
  "system:serviceaccount:kube-system:kubernetes-dashboard" cannot list
  resource "persistentvolumeclaims" in API group "" in the namespace
  "default"</p>
</blockquote>

<p>It does not allow the listing of any resources from my cluster (persistent volumes, pods, ingresses etc). My cluster has multiple namespaces.</p>

<p>This is my service-account yaml file:</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8s-test # replace with your preferred username
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin # replace with your preferred username
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: dashboard-admin # replace with your preferred username
  namespace: kube-system
</code></pre>

<p>Any help is appreciated.</p>

<hr>

<h2> FIX: Create a Role Binding for the cluster role.</h2>

<p>This should fix the problem:</p>

<pre><code>kubectl delete clusterrole cluster-admin
kubectl delete clusterrolebinding kubernetes-dashboard 
kubectl create clusterrolebinding kubernetes-dashboard --clusterrole=cluster-admin --serviceaccount=kube-system:kubernetes-dashboard
</code></pre>

<p>The above command will create a role binding that gives all permissions to all resources.</p>

<hr>

<h2>Run the Proxy:</h2>

<pre><code>kubectl proxy
</code></pre>

<hr>

<h2>Check the DashBoard: Please check the URL and port provided by kubectl</h2>

<pre><code>http://127.0.0.1:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/persistentvolume?namespace=default
</code></pre>

<hr>

<h2> More info: Cluster role:</h2>

<ul>
<li><p>You can check out the 'cluster-admin' role by:</p>

<pre><code>kubectl edit clusterrole cluster-admin
</code></pre></li>
</ul>

<p>The problem here is that the serviceaccount 'kubernetes-dashboard' does not have 'list' permissions for the resource 'persistentVolumeClaims'.</p>
