<p>I have been following a guide on how to setup AWS EKS using terraform. <a href="https://learn.hashicorp.com/tutorials/terraform/eks" rel="nofollow noreferrer">https://learn.hashicorp.com/tutorials/terraform/eks</a></p>
<p>I am on the section where i need to authenticate the dashboard. <a href="https://learn.hashicorp.com/tutorials/terraform/eks#authenticate-the-dashboard" rel="nofollow noreferrer">https://learn.hashicorp.com/tutorials/terraform/eks#authenticate-the-dashboard</a></p>
<ol>
<li>I have created the cluster roll binding</li>
</ol>
<pre><code>$ kubectl apply -f https://raw.githubusercontent.com/hashicorp/learn-terraform-provision-eks-cluster/master/kubernetes-dashboard-admin.rbac.yaml
</code></pre>
<ol start="2">
<li>I have generated the token</li>
</ol>
<pre><code>kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep service-controller-token | awk '{print $1}')
</code></pre>
<ol start="3">
<li>I have logged into the kubernetes dashboard using token. <code>kubectl proxy</code></li>
</ol>
<p>However after im logged in and i try to click on any of the panels to see the resources, i get a set of errors that are similar to the following.</p>
<blockquote>
<p>namespaces is forbidden: User
&quot;system:serviceaccount:kube-system:service-controller&quot; cannot list
resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope</p>
<p>cronjobs.batch is forbidden: User
&quot;system:serviceaccount:kube-system:service-controller&quot; cannot list
resource &quot;cronjobs&quot; in API group &quot;batch&quot; in the namespace &quot;default&quot;</p>
</blockquote>
<p>The messages suggest to me the user im logged in as via the token does not have the permissions to view these resources. Although i am able to view them using <code>kubectl</code> cli tool.</p>
<pre><code>kubectl describe clusterrole kubernetes-dashboard
Name:         kubernetes-dashboard
Labels:       k8s-app=kubernetes-dashboard
Annotations:  &lt;none&gt;
PolicyRule:
  Resources             Non-Resource URLs  Resource Names  Verbs
  ---------             -----------------  --------------  -----
  nodes.metrics.k8s.io  []                 []              [get list watch]
  pods.metrics.k8s.io   []                 []              [get list watch]
</code></pre>

Kay
<p>The following will log you in as an <code>admin-user</code>, which seems to be the behavior you're looking for.</p>
<pre class="lang-sh prettyprint-override"><code>$ ADMIN_USER_TOKEN_NAME=$(kubectl -n kube-system get secret | grep admin-user-token | cut -d' ' -f1)
$ echo $ADMIN_USER_TOKEN_NAME

admin-user-token-k4s7r
# The suffix is auto-generated

$ ADMIN_USER_TOKEN_VALUE=$(kubectl -n kube-system get secret &quot;$ADMIN_USER_TOKEN_NAME&quot; -o jsonpath='{.data.token}' | base64 --decode)
$ echo &quot;$ADMIN_USER_TOKEN_VALUE&quot;

eyJhbGciOiJ ...
.....................-Tg
# Copy this token and use it on the Kubernetes Dashboard login page
</code></pre>
<p>The Service Account that was used in the tutorial is <code>service-controller</code>, which seems to have a very few permissions</p>
<pre class="lang-sh prettyprint-override"><code>$ kubectl -n kube-system describe clusterrole system:controller:service-controller
Name:         system:controller:service-controller
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources             Non-Resource URLs  Resource Names  Verbs
  ---------             -----------------  --------------  -----
  events                []                 []              [create patch update]
  events.events.k8s.io  []                 []              [create patch update]
  services              []                 []              [get list watch]
  nodes                 []                 []              [list watch]
  services/status       []                 []              [patch update]
</code></pre>
<p>Let me know if you have any issues.</p>
