<p>I have a Kubernetes Cluster setup with below topology <a href="https://i.stack.imgur.com/yBVLf.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yBVLf.jpg" alt=""></a></p>

<p>I have deployed Kubernetes Dashboard on the cluster and able to access dashboard with kubectl proxy.</p>

<p>But when I try to access the Dashboard via Floating IP/VIP using the URL:</p>

<pre><code>https://&lt;FloatingIP&gt;:6443/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/login
</code></pre>

<p>I end up with the below response on the browser</p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "services \"https:kubernetes-dashboard:\" is forbidden: User \"system:anonymous\" cannot get resource \"services/proxy\" in API group \"\" in the namespace \"kube-system\"",
  "reason": "Forbidden",
  "details": {
    "name": "https:kubernetes-dashboard:",
    "kind": "services"
  },
  "code": 403
}
</code></pre>

<p>I do understand that the issue is because of RBAC on Kubernetes and did some reading around this topic, but I am still unclear with what needs to be done to resolve this issue on a master clustered implementation. I was able to expose Dashboard successfully on a single master - multiple node setup with NodePort access, but that would fail with Clustered master setup.</p>

<p>I am also open to better suggestions on implementing Dashboard in this topology.</p>

<p>Please let me know if you need any additional information</p>

Sujith Shajee
<p>You will need to create a clusterrole to grant permission to kubernetes-dashboard and bind it to system:anonymous user as followed.</p>
<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubernetes-dashboard-anonymous
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;services/proxy&quot;]
  resourceNames: [&quot;https:kubernetes-dashboard:&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
- nonResourceURLs: [&quot;/ui&quot;, &quot;/ui/*&quot;, &quot;/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/*&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard-anonymous
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubernetes-dashboard-anonymous
subjects:
- kind: User
  name: system:anonymous
</code></pre>
<p><strong>Edit:</strong>
To apply these changes, save it into a .yaml (e.g.: clusterrole.yaml) file and run</p>
<pre><code>kubectl apply -f clusterrole.yaml
</code></pre>
