<p>I am trying to run Kubernetes dashboard. I've followed the steps in the <a href="https://github.com/kubernetes/dashboard/wiki" rel="nofollow noreferrer">official wiki</a>.</p>

<p>Listing kube-system pods, I see:</p>

<pre><code>kubectl get pods -n kube-system
kubernetes-dashboard-head-7478c547df-8bmxf  0/1  CrashLoopBackOff  1  12s
</code></pre>

<p>Restarting this pod causes the same crash. In logs it appears to have crashed because:</p>

<pre><code>kubectl logs -n kube-system kubernetes-dashboard-head-7478c547df-8bmxf  
2019/02/26 23:15:57 Starting overwatch
2019/02/26 23:15:57 Using namespace: kube-system
2019/02/26 23:15:57 Using in-cluster config to connect to apiserver
2019/02/26 23:15:57 Using secret token for csrf signing
2019/02/26 23:15:57 Initializing csrf token from kubernetes-dashboard-csrf secret
panic: secrets "kubernetes-dashboard-csrf" is forbidden: User "system:serviceaccount:kube-system:kubernetes-dashboard-head" cannot get secrets in the namespace "kube-system": RBAC: role.rbac.authorization.k8s.io "kubernetes-dashboard-minimal-head" not found
</code></pre>

<p>I don't fully understand how this can be. The <code>serviceaccounts</code> from this namespace container <code>kubernetes-dashbaord-head</code>:</p>

<pre><code>kubectl get serviceaccounts -n kube-system
kubernetes-dashboard-head            1         8h
</code></pre>

<p>Since this <code>serviceaccount</code> (is this the same as "User"?) is listed in the <code>serviceaccounts</code> under namespace <code>kube-system</code>, why can't it get secrets from that namespace?</p>

<p>With recards to <code>RBAC: role.rbac.authorization.k8s.io ... not found</code>, is this related to this <a href="https://github.com/ubuntu/microk8s/issues/84" rel="nofollow noreferrer">issue</a>?</p>

<p>This is <strong>not</strong> on <code>minikube</code>.</p>

Alexander Kleinhans
<p>First of all, your case <strong>is not</strong> related to this <a href="https://github.com/ubuntu/microk8s/issues/84" rel="nofollow noreferrer">issue</a>. This is just similar error that you get.</p>

<p>You need to have appropriate Role and RoleBinding which you probably don't have, that's why you get this error. 
You can verify with below command:</p>

<pre><code>kubectl get role,rolebinding -n kube-system |grep kubernetes-dashboard-minimal-head
</code></pre>

<p>If you look at latest deployment <a href="https://raw.githubusercontent.com/kubernetes/dashboard/master/aio/deploy/recommended/kubernetes-dashboard-head.yaml" rel="nofollow noreferrer">yaml</a> file of Kubernetes dashboard from your installation guide, you will find below Role and RoleBinding resources.</p>

<pre><code># ------------------- Dashboard Role &amp; Role Binding ------------------- #

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubernetes-dashboard-minimal-head
  namespace: kube-system
rules:
  # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create"]
...

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubernetes-dashboard-minimal-head
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubernetes-dashboard-minimal-head
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard-head
  namespace: kube-system
</code></pre>

<p>But I am not sure how you deployed your deployment, so I would suggest you just delete your deployment yaml file, via</p>

<pre><code>kubectl delete -f &lt;your-deployment-file.yaml&gt;
</code></pre>

<p>then apply latest which includes Role and RoleBindings for Dashboard</p>

<pre><code>kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/master/aio/deploy/recommended/kubernetes-dashboard-head.yaml
</code></pre>

<p>Then you can verify again via:</p>

<pre><code>kubectl get role,rolebinding -n kube-system |grep kubernetes-dashboard-minimal-head
</code></pre>

<p>And check your pods of course.
I hope it would be useful</p>
